SAP-C02 Question 226
Single answerYour company has implemented a multi-account AWS environment using AWS Organizations. The security team has mandated that all IAM users in the member accounts must be able to assume a centralized 'SecurityAudit' role in the organization's management account. However, upon testing, IAM users report that they are unable to assume the role. What is the most likely issue?
- A
The IAM policy attached to the 'SecurityAudit' role in the management account is missing the 'sts:AssumeRole' action.
- B
The trust policy of the 'SecurityAudit' role in the management account does not allow the member account users to assume the role.
- C
The IAM users in the member accounts do not have the required 'sts:AssumeRole' permissions in their policies.
- D
Cross-account access is not supported for roles in multi-account AWS Organizations setups.
Show answer and explanation
Correct answer: B
Explanation
To allow IAM users in member accounts to assume a role in another account, two conditions must be met: the users must have 'sts:AssumeRole' permissions in their own IAM policies, and the trust policy of the target role must allow those users (or their accounts) to assume the role. The issue described in the question is most likely due to a misconfigured trust policy in the management account's 'SecurityAudit' role.
- A. Incorrect.
Incorrect. The IAM policy attached to the role governs what the role itself can do, not who can assume it. The issue here is more likely about permissions to assume the role.
- B. Correct.
Correct. The trust policy of the role specifies which identities (e.g., IAM users, roles) are allowed to assume the role. If the trust policy does not grant permissions to the member account users, they cannot assume the role.
- C. Incorrect.
Incorrect. While IAM users in the member accounts do need 'sts:AssumeRole' permissions, the issue described in the question points to a problem with the trust policy in the management account.
- D. Incorrect.
Incorrect. Cross-account access is fully supported in AWS Organizations setups. The problem most likely lies with permission configuration.