SAP-C02 Practice Question 71: Delegated Role Creation Permissions Boundary
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 8 · question 1 of 10
A company gives application developers self-service access in 20 AWS accounts. Developers must be able to create IAM roles for their own Lambda functions and ECS tasks without waiting for a central team. The security team requires that every role a developer creates can never have more permissions than a fixed set (Amazon S3, DynamoDB and CloudWatch Logs), and that developers cannot create an administrator role or remove the restriction from a role to escape it.
Which solution meets these requirements?
Show answer and explanation
Answer:
AWS states that *"you can use permissions boundaries to delegate permissions management tasks, such as user creation, to IAM users in your account."* A permissions boundary *"sets the maximum permissions that an identity-based policy can grant,"* so a role created with the approved boundary can never exceed S3, DynamoDB and CloudWatch Logs, whatever policies are later attached to it. In the delegation pattern, the developer's own permissions allow iam:CreateRole (and attaching policies) only *"if he uses the [approved] policy to set the permissions boundary,"* and explicit denies stop the developer from editing the boundary policy or deleting the boundary from a role (option B).
- A is wrong because IAMFullAccess lets a developer create an administrator role immediately. A weekly audit detects the escalation after the fact. - C is wrong because it removes the self-service that the company wants and turns the central team into a bottleneck, although it would be secure. - D is wrong because a session policy only limits the developer's own session. It does not put any limit on the permissions of the roles that the developer creates.
Reference: Permissions boundaries for IAM entities