A company allows its developers to attach existing IAM policies to existing IAM roles to enable faster experimentation and agility. However, the security operations team is concerned that the developers could attach the existing administrator policy, which would allow the developers to circumvent any other security policies.
How should a solutions architect address this issue?

A. Create an Amazon SNS topic to send an alert every time a developer creates a new policy.

B. Use service control policies to disable IAM activity across all accounts in the organizational unit.

C. Prevent the developers from attaching any policies and assign all IAM duties to the security operations team.

D. Set an IAM permissions boundary on the developer IAM role that explicitly denies attaching the administrator policy.








 

Suggested Answer: D

Community Answer: D

Reference:
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html


This question is in SAA-C02 AWS Certified Solutions Architect – Associate Exam
For getting AWS Certified Solutions Architect – Associate Certificate




Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by Amazon.
Trademarks, certification & product names are used for reference only and belong to Amazon.
The website does not contain actual questions and answers from Amazon's Certification Exam.