SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

Refer to the exhibit. A company has a trust policy on an IAM role in account 222222222222. The trust policy allows the root user of account 111111111111 to assume the role. However, a user in account 111111111111 is unable to assume the role. What is the most likely cause?

⚠ Common exam trap

It's easy for candidates to confuse the root user ARN (which represents the account but only grants access to the root user) with allowing all IAM users in the account, leading them to overlook the need to specify individual user ARNs or use a condition for broader access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The trust policy only allows the root user, not individual users

The trust policy explicitly allows only the root user of account 111111111111 (arn:aws:iam::111111111111:root) to assume the role. Individual IAM users within that account are not granted permission unless the trust policy includes the specific user ARN or a condition that allows federated access. Since the user is not the root user, the sts:AssumeRole call fails due to the principal restriction in the trust policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A service control policy in account 222222222222 is denying the sts:AssumeRole action
Why it's wrong here
SCPs could deny but the trust policy is the more direct issue.
✗
The role is not in the same region as the user
Why it's wrong here
IAM roles are global.
✓
The trust policy only allows the root user, not individual users
Why this is correct
The principal is the root user ARN; individual users need a separate ARN or permissions.
✗
The trust policy is malformed
Why it's wrong here
The policy is syntactically correct.

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question