SAA-C03 Q583 · Security

Question

A company uses AWS Organizations to manage multiple AWS accounts. The company needs a secure, event- driven architecture in which specific Amazon SNS topics in Account A can publish messages to specific Amazon SQS queues in Account B. Which solution meets these requirements while maintaining least privilege?

Accepted Answer

Answer C is correct because it implements **bidirectional least privilege** using resource-based policies on both sides:

1. **SQS Queue Policy in Account B**: Modified to allow **only specific SNS topic ARNs** from Account A. This means the queue won't accept messages from any arbitrary SNS topic — only the explicitly listed ones.

2. **SNS Topic Subscription/Publish Permissions**: The SNS topics in Account A are configured with permissions to publish to **specific queue ARNs** — not all queues, just the designated ones.

This satisfies every requirement:
- ✅ **Cross-account**: Resource-based policies (SQS queue policy + SNS topic policy) natively support cross-account access without sharing IAM roles.
- ✅ **Event-driven**: SNS → SQS is a classic event-driven fan-out pattern.
- ✅ **Least

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips