SAA-C03 Q677 · IAM

Question

A company wants DevOps teams to create IAM roles, but no role may have administrative permissions. Which solution will meet these requirements?

Accepted Answer

**Option B: Use SCPs to require a permissions boundary when creating IAM roles.**

This is the correct answer because it satisfies both requirements simultaneously:

1. **DevOps teams CAN create IAM roles** — The SCP doesn't block `iam:CreateRole`. It only adds a condition.

2. **No role may have administrative permissions** — The SCP uses a `Condition` key (`iam:PermissionsBoundary`) to enforce that every `iam:CreateRole` call must attach a specific permissions boundary. That boundary is pre-configured to exclude administrative permissions.

**How it works step-by-step:**
- An Organization SCP is written that denies `iam:CreateRole` (and `iam:AttachRolePolicy`, `iam:PutRolePolicy`) **unless** the request includes a specific permissions boundary ARN.
- The permissions boundary itself is a

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips