Configuring Cross-Account IAM Role Access in AWS
A security engineer is investigating an IAM role that was used to access AWS resources from an external account. The role has a trust policy that allows the external account to assume it. Which of the following is a required step for the external account to use the role?
Quick Answer
The correct answer is to attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN. This is required because cross-account IAM role access configuration relies on a two-part permission model: the trusting account’s role must have a trust policy granting access to the external account, and the external account must explicitly delegate the sts:AssumeRole action to its own users or roles. Without that delegation, the external account’s principal lacks the authorization to initiate the role assumption, even if the trust policy is correctly set. On the AWS Certified Security Specialty SCS-C02 exam, this concept tests your understanding of the separation between trust policies and identity-based permissions—a common trap is assuming the trust policy alone is sufficient. Remember the memory tip: “Trust opens the door, but permission lets you walk through.”
⚠ Common exam trap
SCS-C02 often tests the two-sided permission requirement for cross-account role assumption; candidates may forget that the external account must also have an identity-based policy allowing sts:AssumeRole, not just the trust policy on the role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.
For an external account to assume an IAM role in another account, an IAM user or role in the external account must have an IAM policy that allows the sts:AssumeRole action for the role's ARN. This is a required step because the external account's identity needs permission to call AssumeRole. The trust policy on the role allows the external account to assume it, but the external account must also grant its own identity the permission to assume that role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the role to require MFA for the external account.
Why it's wrong here
MFA is optional hardening, not a prerequisite for cross-account assumption. The external principal must first be granted sts:AssumeRole permission in its own identity policy, then call AssumeRole with the role ARN. Requiring MFA suits privileged human access via IAM users, not service-to-service role chaining.
- ✗
Create a new IAM role in the external account with a trust policy allowing the role's ARN.
Why it's wrong here
The external account must attach an identity-based policy granting sts:AssumeRole for the role's ARN; creating a second role with a trust policy reverses the direction. It is tempting because trust policies do govern assumption, and it would be correct when the external account hosts the role being assumed.
- ✗
Add the external account's root user ARN to the role's trust policy.
Why it's wrong here
The trust policy already allows the external account; adding root user ARN is not needed.
- ✓
Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.
Why this is correct
Cross-account access needs two sides: the trust policy in the owning account and an identity-based policy in the external account granting sts:AssumeRole on the role ARN. Without that permission attached to the calling principal, the AssumeRole call is denied.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which IAM entity can be used to grant temporary access to AWS resources for users from a different AWS account?
easy- A.IAM group
- ✓ B.IAM role
- C.IAM policy
- D.IAM user
Why B: An IAM role is the correct entity because it is specifically designed to grant temporary, cross-account access to AWS resources. When a user from a different AWS account assumes a role, AWS STS (Security Token Service) issues temporary security credentials (access key, secret key, and session token) that are valid for a configurable duration (default 1 hour, max 12 hours). This avoids the need to create permanent IAM users or share long-term credentials across accounts.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.