SAA-C03 Q439 · IAM

Question

A company needs to provide a team of contractors with temporary access to the company's AWS resources for a short-term project. The contractors need different levels of access to AWS services. The company needs to revoke permissions for all the contractors when the project is finished. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

**Option B — AWS STS with temporary credentials and predefined roles** satisfies every requirement:

1. **Temporary access**: STS is purpose-built for generating short-lived, temporary security credentials. These credentials have a defined expiration time, which aligns perfectly with a short-term project.

2. **Different levels of access**: By defining **predefined IAM roles** with different policies, each contractor (or contractor group) can assume the appropriate role for their required access level. Each role carries its own set of permissions.

3. **Automatic revocation**: The credentials issued by STS **expire automatically** based on the configured duration (from 15 minutes up to 36 hours for AssumeRole, or up to 12 hours with session policies). When the project ends, you simply stop

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips