SAP-C02 Q74 · IAM

Question

A company is running several workloads in a single AWS account. A new company policy states that engineers can provision only approved resources and that engineers must use AWS CloudFormation to provision these resources. A solutions architect needs to create a solution to enforce the new restriction on the IAM role that the engineers use for access. What should the solutions architect do to create the solution?

Accepted Answer

Option C correctly implements a **separation of privileges** pattern using a CloudFormation service role:

1. **Requirement: Engineers must use CloudFormation** → The engineers' IAM role is restricted to ONLY CloudFormation actions (e.g., cloudformation:CreateStack, cloudformation:UpdateStack). They cannot directly call EC2, RDS, or any other service APIs.

2. **Requirement: Only approved resources can be provisioned** → A separate IAM service role is created with permissions to provision ONLY the approved resources. This role is assigned to CloudFormation.

3. **How it works**: When an engineer creates a stack, they pass the service role to CloudFormation. CloudFormation **assumes that service role** to create the actual resources. The engineer never directly has permissions to create tho

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips