ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Solutions Architect - Associate SAA-C03 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Associate SAA-C03 exam
Go to Exam

Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 387 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C03
Question #: 387
Topic #: 1
[All AWS Certified Solutions Architect - Associate SAA-C03 Questions]

A new employee has joined a company as a deployment engineer. The deployment engineer will be using AWS CloudFormation templates to create multiple AWS resources. A solutions architect wants the deployment engineer to perform job activities while following the principle of least privilege.

Which combination of actions should the solutions architect take to accomplish this goal? (Choose two.)

  • A. Have the deployment engineer use AWS account root user credentials for performing AWS CloudFormation stack operations.
  • B. Create a new IAM user for the deployment engineer and add the IAM user to a group that has the PowerUsers IAM policy attached.
  • C. Create a new IAM user for the deployment engineer and add the IAM user to a group that has the AdministratorAccess IAM policy attached.
  • D. Create a new IAM user for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only.
  • E. Create an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using that IAM role.
Show Suggested Answer Hide Answer
Suggested Answer: DE 🗳️
by [deleted] at March 10, 2023, 3:46 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
truongtx8
Highly Voted 5 months ago
Selected Answer: DE
The answers inside the question: CloudFormation. A is exlucded since root account is never a choice for the principle of least privilege. D, E left are the correct ones.
upvoted 5 times
...
awsgeek75
Most Recent 5 months, 1 week ago
Selected Answer: DE
ABC are just giving too much access so CD are logical choices
upvoted 3 times
...
TariqKipkemei
8 months, 1 week ago
Selected Answer: DE
Create a new IAM user for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only. Create an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using that IAM role.
upvoted 3 times
...
Guru4Cloud
9 months, 3 weeks ago
Selected Answer: DE
The two actions that should be taken to follow the principle of least privilege are: D) Create a new IAM user for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only. E) Create an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using that IAM role. The principle of least privilege states that users should only be given the minimal permissions necessary to perform their job function.
upvoted 4 times
...
alexandercamachop
1 year ago
Selected Answer: DE
Option D, creating a new IAM user and adding them to a group with an IAM policy that allows AWS CloudFormation actions only, ensures that the deployment engineer has the necessary permissions to perform AWS CloudFormation operations while limiting access to other resources and actions. This aligns with the principle of least privilege by providing the minimum required permissions for their job activities. Option E, creating an IAM role with specific permissions for AWS CloudFormation stack operations and allowing the deployment engineer to assume that role, is another valid approach. By using an IAM role, the deployment engineer can assume the role when necessary, granting them temporary permissions to perform CloudFormation actions. This provides a level of separation and limits the permissions granted to the engineer to only the required CloudFormation operations.
upvoted 3 times
...
Babaaaaa
1 year ago
Selected Answer: DE
Dddd,Eeee
upvoted 2 times
...
elearningtakai
1 year, 2 months ago
Selected Answer: DE
D & E are a good choices
upvoted 2 times
...
aragon_saa
1 year, 3 months ago
D, E https://www.examtopics.com/discussions/amazon/view/46428-exam-aws-certified-solutions-architect-associate-saa-c02/
upvoted 4 times
mwwt2022
5 months, 3 weeks ago
thank you my friend
upvoted 2 times
...
...
fruto123
1 year, 3 months ago
Selected Answer: DE
I agree DE
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago