DOP-C02 · Question #205
A company's application teams use AWS CodeCommit repositories for their applications. The application teams have repositories in multiple AWS accounts. All accounts are in an organization in AWS…
The correct answer is A. Update the SAML assertion to pass the user's team name. Update the IAM role's trust policy to C. Create an approval rule template for each account. Associate the template with all repositories. E. E. Attach an SCP to the accounts. Include the following statement. Explanation Options A, C, and E work together to form a complete, layered security solution: A updates the SAML assertion to pass team identity as a session tag and restricts the IAM role's trust policy so that users can only assume roles matching their team context; C creates…
Question
A company's application teams use AWS CodeCommit repositories for their applications. The application teams have repositories in multiple AWS accounts. All accounts are in an organization in AWS Organizations. Each application team uses AWS IAM Identity Center (AWS Single Sign-On) configured with an external IdP to assume a developer IAM role. The developer role allows the application teams to use Git to work with the code in the repositories. A security audit reveals that the application teams can modify the main branch in any repository. A DevOps engineer must implement a solution that allows the application teams to modify the main branch of only the repositories that they manage. Which combination of steps will meet these requirements? (Choose three.)
Options
- AUpdate the SAML assertion to pass the user's team name. Update the IAM role's trust policy to
- BCreate an approval rule template for each team in the Organizations management account.
- CCreate an approval rule template for each account. Associate the template with all repositories.
- DFor each CodeCommit repository, add an access-team tag that has the value set to the name of
- EE. Attach an SCP to the accounts. Include the following statement:
- FCreate an IAM permissions boundary in each account. Include the following statement:
How the community answered
(64 responses)- A64% (41)
- B5% (3)
- D19% (12)
- F13% (8)
Explanation
Explanation
Options A, C, and E work together to form a complete, layered security solution: A updates the SAML assertion to pass team identity as a session tag and restricts the IAM role's trust policy so that users can only assume roles matching their team context; C creates approval rule templates per account and associates them with all repositories, enforcing a review gate on the main branch; and E attaches an SCP to restrict CodeCommit push/merge actions on the main branch unless the repository's access-team tag matches the user's team session tag, ensuring cross-account enforcement at the organizational level.
Why the distractors are wrong:
- B is incorrect because creating approval rule templates in the management account doesn't apply them to repositories in member accounts - templates are account-scoped.
- D alone is insufficient because simply tagging repositories doesn't enforce any restriction without an accompanying policy (like an SCP) that evaluates those tags.
- F is incorrect because a permissions boundary sets the maximum permissions for IAM entities within an account but doesn't provide the tag-based conditional enforcement needed across the organization.
Memory Tip
Think "TAG → TRUST → ENFORCE": tag the resource (via SCP conditions), trust the right identity (SAML + role trust policy), and enforce at scale (approval templates per account). SCPs + session tags are the classic AWS cross-account attribute-based access control (ABAC) pattern.
Topics
Community Discussion
No community discussion yet for this question.