IAM Roles for Least Privilege Access Control

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Define IAM roles that have fine-grained permissions based on the principle of least privilege and assign them to each developer.

Question

A company needs to grant a team of developers access to the company's AWS resources. The company must maintain a high level of security for the resources. The company requires an access control solution that will prevent unauthorized access to the sensitive data. Which solution will meet these requirements?
  1. Share the IAM user credentials for each development team member with the rest of the team to simplify access management and to streamline development workflows.
  2. Define IAM roles that have fine-grained permissions based on the principle of least privilege. Assign an IAM role to each developer. Correct Answer
  3. Create IAM access keys to grant programmatic access to AWS resources. Allow only developers to interact with AWS resources through API calls by using the access keys.
  4. Create an AWS Cognito user pool. Grant developers access to AWS resources by using the user pool.

Key Takeaways

The core concept tested is Identity and Access Management (IAM) best practices, specifically the trap of confusing user-based credential management with role-based temporary security credentials.

This question evaluates the correct method for granting secure, fine-grained access to AWS resources using IAM roles and the principle of least privilege. It establishes why sharing credentials or using static keys is insecure compared to temporary role-based access.

Common mistake: Candidates often choose Option C because it mentions 'programmatic access,' but they fail to recognize that managing static access keys for multiple developers creates significant security risks and operational overhead compared to roles.

Expert Analysis

Why the Answer Is Correct

Option B is the only solution that aligns with AWS security best practices by utilizing IAM roles. Roles provide temporary security credentials automatically, eliminating the need to distribute long-term secrets. By assigning a unique role to each developer with permissions scoped to the principle of least privilege, the company ensures that developers only have access to the specific resources they require, minimizing the blast radius of any potential compromise.

Why the Other Options Are Wrong

Option A is critically insecure as sharing IAM user credentials violates fundamental security principles and makes audit trails impossible. Option C, while technically possible, requires managing static access keys which are prone to leakage and do not offer the automatic rotation benefits of roles. Option D is incorrect because AWS Cognito is designed for external end-users (web/mobile app users), not internal employees accessing AWS infrastructure.

Community Comment Notes

The community consensus strongly supports B, noting that roles allow for automatic credential rotation. As LeonSauveterre noted, "A - Sharing IAM user credentials is a security risk... B - IAM roles allow for temporary credentials." Some learners like KennethYY initially questioned if roles could be assigned to users, but clarified that roles are assumed rather than directly attached, making B still the correct conceptual answer over the others.

Official Reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always look for 'least privilege' and 'temporary credentials' in security questions. If you see options involving sharing passwords or static keys, they are almost always wrong. Roles are the preferred mechanism for granting access between AWS services or to trusted entities.

Frequently Asked Questions

Can IAM roles be assigned directly to IAM users?

No. Users must assume the role via the AssumeRole API call. The role provides temporary credentials, whereas users have permanent credentials.

Why is AWS Cognito not suitable for internal developers?

Cognito is built for external end-users of web or mobile applications. Internal employees should use standard IAM identities or federated identity providers like Active Directory.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. Cpso 👍 2 Answered B
    good practice should B. but map role to Identity center federated to corporate IDP.
  2. Bwhizzy 👍 2 Answered B
    B is the right answer. IAM Role
  3. LeonSauveterre 👍 1 Answered B
    A - Sharing IAM user credentials is a security risk and violates AWS best practices. B - IAM roles allow for temporary credentials that can be automatically rotated, and that improves security. C - Would work but managing static keys for multiple developers introduces significant operational overhead. D - AWS Cognito is primarily designed for managing end-user authentication (for web or mobile apps or such), not for managing access to AWS resources for developers.
  4. KennethYY 👍 1 Answered D
    A is wrong, common sense not security B is wrong, role cannot assign to user/group D is wrong, is designed for authentication and access control for web or mobile app users, not for internal developers accessing AWS resources. so remain C.
  5. EllenLiu 👍 1 Answered B
    AWS Cognito is designed for authentication and access control for web or mobile app users, not for internal developers accessing AWS resources.
Show 3 more comments
  1. muhammadahmer36 👍 1
    Create an AWS Cognito user pool. Grant developers access to AWS resources by using the user pool.
  2. aragon_saa 👍 3 Answered B
    Answer is B
  3. EllenLiu 👍 1
    Sorry, go with B.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide