AWS Certified Solutions Architect – Associate (SAA-C02) — Question 48

A company allows its developers to attach existing IAM policies to existing IAM roles to enable faster experimentation and agility. However, the security operations team is concerned that the developers could attach the existing administrator policy, which would allow the developers to circumvent any other security policies.
How should a solutions architect address this issue?

Answer options

• A. Create an Amazon SNS topic to send an alert every time a developer creates a new policy.
• B. Use service control policies to disable IAM activity across all accounts in the organizational unit.
• C. Prevent the developers from attaching any policies and assign all IAM duties to the security operations team.
• D. Set an IAM permissions boundary on the developer IAM role that explicitly denies attaching the administrator policy.

Correct answer: D

Explanation

The correct answer, D, ensures that developers are restricted from attaching the administrator policy, thus maintaining security while allowing flexibility. Options A and B do not directly address the risk of policy attachment, and option C removes the developers' ability to manage IAM roles entirely, which is not a practical solution.