Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 1017 discussion

https://docs.aws.amazon.com/eks/latest/userguide/service-accounts.html#service-accounts-iam

IRSA allows Kubernetes service accounts to assume IAM roles, enabling fine-grained access control for EKS Pods. This ensures that each Pod can access only the AWS resources it needs. Attach the AmazonDynamoDBFullAccess policy to the service account for the UI Pods, allowing them to access only DynamoDB. Attach the AmazonS3FullAccess policy to the service account for the data services Pods, allowing them to access only S3.

A - This is a major security flaw. All Pods running on the EC2 instances would inherit both the S3 and DynamoDB permissions. B - Directly attaching IAM policies to Pods is not a valid AWS mechanism. You should use roles. C - Not recommended unless we throw least privilege principles to the wind. BUT this is the only feasible option here, so. D - This option mixes up the permissions. It gives UI Pods access to S3 and data service Pods access to DynamoDB, which is the OPPOSITE of the requirement.

D is sneakily WRONG because it swaps the services incorrectly. Pay attention. UWC.

Even though there are a couple of comments rightfully discarding "D" because the UI --> S3/DataServices --> DynamoDB swap, I found an AWS document claiming that Kubernetes Service accounts and IAM Role for Service Accounts combination should be the right answer: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html Having this in mind, I'm also discarding "D" (right reasoning, wrong scenario), as well "A" and "B". I didn't like the "full access" policy, but is technically correct, so my vote goes to "C"

* A. Attach both IAM policies to the EC2 instance profile. Does not separate each EKS Pod * B. Aws does not support Attach the Amazon S3 IAM policy directly to the EKS Pods * * D. provide access “UI to Amazon S3” and “data services to DynamoDB” => it does not meet requirements

The answer is C as they're switching data pods with DynamoDB service and vice versa (configure the wrong resources)

answer is D