SAP-C02 Practice Question 91: Role Chaining Session Duration
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 10 · question 1 of 10
A nightly batch job runs in a shared-services account under a job role. The job assumes RoleB in a network account, and then uses RoleB's credentials to assume RoleC in a data account, where it calls AssumeRole with DurationSeconds set to 14,400 (4 hours) because the job needs about four hours. RoleC has a maximum session duration of 12 hours. The second AssumeRole call fails.
Which change should the solutions architect make to let the job use a four-hour session?
Show answer and explanation
Answer:
*"Role chaining is when you use a role to assume a second role."* AWS states that *"role chaining limits your AWS Management Console, AWS CLI or AWS API role session to a maximum of one hour. It applies regardless of the maximum session duration configured for individual roles."* It adds that if you assume a role using role chaining and *"provide a DurationSeconds parameter value greater than one hour, the operation fails."* If the job role assumes RoleC directly (with a trust policy that allows it), the request is not chained, so a 4-hour session is possible within the role's 12-hour maximum (option D).
- A is wrong because the role's maximum session duration is not the limit that is being hit. The one-hour limit applies to chained sessions whatever the role's setting. - B is wrong because the SDK cannot extend a session beyond its expiry. A one-hour session would end before the four-hour job finishes unless the job re-assumes the role. - C is wrong because long-term access keys are a weaker pattern, and AWS recommends temporary credentials from roles for workloads.
Reference: IAM roles: roles terms and concepts