SCS-C03 Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an IAM user in Account B for the developer and provide the static access keys to the developer in Account A.

  Why it's wrong here

  Creating static IAM users across multiple accounts leads to credential sprawl and increased management overhead. Hardcoded access keys are a significant security risk if they are leaked or not rotated regularly. Best practices dictate using temporary credentials through IAM roles for cross-account access instead of permanent user keys.

• ✗

  Define a resource-based policy on the S3 bucket in Account B that grants the developer's IAM ARN in Account A direct access.

  Why it's wrong here

  While S3 bucket policies allow cross-account access directly to an ARN, this method becomes difficult to manage at scale. It requires updating the bucket policy for every new user or change in personnel. Using a role-based delegation provides a cleaner abstraction for managing permissions and auditing access via CloudTrail.

• ✓

  Create an IAM role in Account B with the required S3 permissions and a trust policy allowing Account A, then let the developer assume it.

  Why this is correct

  This method follows the principle of least privilege and uses AWS Security Token Service for temporary access. The trust policy defines who can assume the role, and the identity-based policy defines what they can do. This architecture is scalable and aligns with the AWS Well-Architected Framework security pillar.

• ✗

  Configure a VPC Peering connection between Account A and Account B to allow the developer to access the S3 bucket privately.

  Why it's wrong here

  VPC Peering provides network connectivity but does not handle the Identity and Access Management layer required for S3 operations. Even with a peering connection, the developer still needs the appropriate IAM permissions to interact with the S3 API. Networking and identity are distinct layers that must both be correctly configured.