SAA-C03 Q675 · IAM

Question

A company needs to allow a vendor to access CloudWatch Logs in the company's AWS account by using IAM roles for cross-account access. Which solution will meet these requirements?

Accepted Answer

**Answer D: Create a role in the company account with permissions and trust the vendor role.**

Cross-account access with IAM roles follows a precise pattern:

1. **Where is the resource?** → The company's account (CloudWatch Logs live here)
2. **Who needs access?** → The vendor (from the vendor's account)
3. **Where do you create the role?** → In the **resource-owning account** (company account)
4. **What permissions does the role need?** → Permissions to access CloudWatch Logs (e.g., `logs:GetLogEvents`, `logs:DescribeLogGroups`)
5. **Who do you trust?** → The **vendor's account/role** (the entity that will assume this role)

The trust policy on the role in the company account specifies the vendor's AWS account (or specific role ARN) as a trusted principal. This allows IAM entities in th

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips