Configuring Cross-Account IAM Role Access in AWS
A security engineer is investigating an IAM role that was used to access AWS resources from an external account. The role has a trust policy that allows the external account to assume it. Which of the following is a required step for the external account to use the role?
Quick Answer
The correct answer is to attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN. This is required because cross-account IAM role access configuration relies on a two-part permission model: the trusting account’s role must have a trust policy granting access to the external account, and the external account must explicitly delegate the sts:AssumeRole action to its own users or roles. Without that delegation, the external account’s principal lacks the authorization to initiate the role assumption, even if the trust policy is correctly set. On the AWS Certified Security Specialty SCS-C02 exam, this concept tests your understanding of the separation between trust policies and identity-based permissions—a common trap is assuming the trust policy alone is sufficient. Remember the memory tip: “Trust opens the door, but permission lets you walk through.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.
To assume a role in another AWS account, the external account must have an IAM user or role with permissions to call the sts:AssumeRole API for the target role ARN. Option D correctly describes this requirement. Option A is incorrect because MFA is not a required step unless specified in the role's trust policy. Option B is incorrect because the external account does not need to create a new role; it only needs a principal (user or role) with the appropriate permissions. Option C is incorrect because the trust policy is attached to the role in the target account, not the external account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the role to require MFA for the external account.
Why it's wrong here
MFA is optional and not required for basic access.
- ✗
Create a new IAM role in the external account with a trust policy allowing the role's ARN.
Why it's wrong here
The external account does not create a role; it uses its own users/roles to assume the role.
- ✗
Add the external account's root user ARN to the role's trust policy.
Why it's wrong here
The trust policy already allows the external account; adding root user ARN is not needed.
- ✓
Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.
Why this is correct
The external user needs permission to assume the role.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which IAM entity can be used to grant temporary access to AWS resources for users from a different AWS account?
easy- A.IAM group
- ✓ B.IAM role
- C.IAM policy
- D.IAM user
Why B: An IAM role is the correct entity because it is specifically designed to grant temporary, cross-account access to AWS resources. When a user from a different AWS account assumes a role, AWS STS (Security Token Service) issues temporary security credentials (access key, secret key, and session token) that are valid for a configurable duration (default 1 hour, max 12 hours). This avoids the need to create permanent IAM users or share long-term credentials across accounts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.