SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::*:role/OrganizationAccountAccessRole"
    }
  ]
}

Refer to the exhibit. An IAM policy is attached to a user in the management account of AWS Organizations. The user wants to assume the OrganizationAccountAccessRole in a member account. However, the user receives an access denied error. What is the most likely reason?

⚠ Common exam trap

Candidates often assume SCPs are the cause of cross-account access denials, but SCPs do not apply to principals in the management account; the real issue is almost always the trust policy on the target role.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The trust policy of the OrganizationAccountAccessRole in the member account does not grant access to the management account.

The OrganizationAccountAccessRole in the member account must have a trust policy that explicitly allows the management account's IAM user (or the management account itself) to assume the role. Without this trust relationship, the sts:AssumeRole call from the management account user will be denied, even if the user's IAM policy grants permission to assume the role.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The trust policy of the OrganizationAccountAccessRole in the member account does not grant access to the management account.
Why this is correct
The role must trust the management account to allow AssumeRole.
✗
The IAM role does not exist in the same region as the user.
Why it's wrong here
IAM is global.
✗
An SCP in the member account denies the sts:AssumeRole action.
Why it's wrong here
Possible but not the most likely; the role trust policy is a common issue.
✗
The policy does not specify the exact member account ARN.
Why it's wrong here
Wildcard allows all accounts.

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question