Design Secure Architectures
Free AWS Certified Solutions Architect – Associate (SAA-C04) practice — 6 questions on Design Secure Architectures, with explanations. No sign-up. Full 12-question mixed test →
An S3 bucket containing encrypted objects lives in Account A, encrypted with a customer managed KMS key also owned by Account A. A Lambda function in Account B already has s3:GetObject permission via the bucket policy and needs to decrypt these objects at runtime. What must be configured so the Lambda function can successfully call kms:Decrypt?
Cross-account KMS access always requires permission on BOTH sides: the key policy (resource-based) must explicitly allow the external account's principal, AND that principal's own identity-based IAM policy must also allow the kms:Decrypt action on the key. Neither side alone is sufficient for cross-account calls, unlike same-account access where the key's default 'Enable IAM User Permissions' statement lets IAM policies alone govern access.
A team lead in a shared AWS account is permitted to create new IAM roles for developers on their team. Security requires that no role the team lead creates can ever be granted permissions beyond S3 read-only and DynamoDB read-only, even if the team lead later attaches a more permissive managed policy by mistake. Which control enforces this?
A permissions boundary sets the maximum permissions a role can ever have, regardless of what identity-based policies are later attached to it. Requiring the team lead's role-creation permissions (via IAM policy condition) to always include this boundary ensures any role they create is hard-capped at S3/DynamoDB read, even if an overly permissive policy is attached afterward.
EC2 instances in a private subnet with no internet access must retrieve values from Secrets Manager, but only from a specific subset of secrets tagged Environment=prod. All traffic must stay on the AWS network. Which configuration BEST meets this requirement?
Secrets Manager is accessed via an interface VPC endpoint (PowerLink), not a gateway endpoint (gateway endpoints only support S3 and DynamoDB). VPC endpoint policies control which API calls/resources are reachable through that specific endpoint, and this must be paired with an identity-based IAM policy on the instance role scoping GetSecretValue to the specific prod secret ARNs — endpoint policies alone don't replace IAM permission checks.
A company runs an RDS MySQL database and needs the master user password to rotate automatically every 30 days without any application downtime or manual intervention, using AWS-managed rotation logic. Which service and configuration satisfies this requirement?
Secrets Manager provides native, built-in rotation support for RDS, Aurora, Redshift, and DocumentDB credentials — AWS supplies pre-built Lambda rotation functions that handle the rotation, update the database, and update the secret atomically with zero required custom code, satisfying the 'no manual intervention' and 'no downtime' requirements out of the box.
An AWS Organizations SCP attached to an OU explicitly denies the iam:CreateUser action for all accounts in that OU. Within one of those accounts, an IAM administrator has an identity-based policy attached to their role granting iam:CreateUser with a resource of '*'. What happens when the administrator attempts to create an IAM user?
SCPs define the outer boundary of permissions available within an account or OU — they never grant permissions themselves, but any explicit deny in an SCP is absolute and cannot be overridden by any IAM policy, including administrator-level allows. The final effective permission is always the intersection of SCP permissions and IAM policy permissions.
A company must encrypt objects across three S3 buckets used by dev, staging, and prod environments. Security requires that a compromised or over-permissioned IAM role in the dev account can never be used to decrypt prod objects, and each environment's KMS key usage must be independently auditable via CloudTrail. Which design BEST meets these requirements?
Separate customer managed keys per environment provide true cryptographic isolation — even if IAM policies are misconfigured, a dev role has no path to decrypt prod objects because the prod key's key policy never trusts dev principals. Each key also generates its own CloudTrail KMS API events, giving independent auditability, and automatic annual rotation satisfies key hygiene requirements at no extra design cost.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through September 2.
Get my $34.99 deal →