Cross-Account IAM Role Trust Policy Configuration
A company wants to allow users from an external AWS account to assume an IAM role in its account. What must be configured in both accounts?
Quick Answer
The correct answer is that both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole must be configured. This is because cross-account IAM role access requires a two-sided permission model: the trusting account (the role owner) must explicitly define a trust policy that designates the external account as a trusted principal, while the external account must grant its users an IAM policy with the sts:AssumeRole action to actually invoke the role. On the AWS Certified Security Specialty SCS-C02 exam, this concept tests your understanding of the shared responsibility in cross-account access—a common trap is assuming only one side needs configuration, such as thinking the trust policy alone is sufficient. A reliable memory tip is to remember the "handshake" rule: the trusting account opens the door (trust policy), and the external account provides the key (sts:AssumeRole permission).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole.
Cross-account role access requires configuration on both sides: the trusting account (where the role resides) must have a trust policy that allows the external account to assume the role, and the external account must have an IAM policy that grants its users permission to call sts:AssumeRole targeting that role. Option A is incorrect because an IAM password policy is unrelated to cross-account role access. Option B is incorrect because while the trusting account's trust policy is necessary, the external account also needs to grant sts:AssumeRole permission to its users. Option C is incorrect because the external account's policy alone is insufficient without the trusting account's trust policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An IAM password policy in both accounts.
Why it's wrong here
Incorrect. An IAM password policy is unrelated to cross-account role access. Both accounts do not need a password policy for this scenario.
- ✗
Only the trusting account's role trust policy.
Why it's wrong here
Incorrect. The trusting account's role trust policy is necessary, but not sufficient. The external account must also have an IAM policy allowing its users to call sts:AssumeRole.
- ✗
Only the external account's IAM policy to allow sts:AssumeRole.
Why it's wrong here
Incorrect. The external account's IAM policy to allow sts:AssumeRole is necessary, but not sufficient. The trusting account must also have a trust policy allowing the external account.
- ✓
Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole.
Why this is correct
Correct. Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole are required for cross-account role access.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses cross-account IAM roles to allow a third-party vendor to access resources in the company's AWS account. The security team wants to ensure that the vendor can only access the specific S3 bucket named 'vendor-bucket'. What should the security team do?
hard- A.Create an IAM user for the vendor and attach a policy that allows access to 'vendor-bucket'.
- ✓ B.In the trust policy of the role, specify the vendor's AWS account and attach a permissions policy that allows s3:* on 'vendor-bucket'. Also create a bucket policy that allows the role.
- C.Use an SCP to deny access to all S3 buckets except 'vendor-bucket'.
- D.Create a new AWS account for the vendor and use VPC peering.
Why B: The correct approach is to create a cross-account IAM role for the vendor. In the role's trust policy, specify the vendor's AWS account as the trusted entity. Attach a permissions policy to the role that grants access only to the specific S3 bucket 'vendor-bucket' (e.g., s3:GetObject, s3:PutObject). Additionally, create a bucket policy on 'vendor-bucket' that allows the role to access the bucket. This ensures the vendor can only assume the role and access the designated bucket.
Variation 2. A security engineer is designing a cross-account IAM role to allow users in Account A to access resources in Account B. The engineer wants to restrict access to only users who have authenticated with multi-factor authentication (MFA) in Account A. What condition key should the engineer use in the trust policy of the IAM role in Account B?
hard- A.aws:SourceIp
- ✓ B.aws:MultiFactorAuthPresent
- C.aws:RequestedRegion
- D.aws:UserAgent
Why B: Aws:MultiFactorAuthPresent is the condition key used to verify whether the requesting user authenticated using multi-factor authentication (MFA). In a trust policy, this condition ensures that only MFA-authenticated users from Account A can assume the role in Account B. Option A (aws:SourceIp) is incorrect because it checks the source IP address, not MFA status. Option C (aws:RequestedRegion) is incorrect because it restricts based on the AWS region, not MFA. Option D (aws:UserAgent) is incorrect because it checks the user agent string of the request, not MFA.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.