nerdexam
Amazon

DVA-C02 · Question #353

A company stores all personally identifiable information (PII) in an Amazon DynamoDB table named PII in Account A. Developers are working on an application that is running on Amazon EC2 instances in…

The correct answer is A. Allow the EC2 IAM role the permission to assume the AccessPII role. D. Include the AssumeRole API operation in the application code logic to obtain temporary. Cross-account access requires the EC2 role in Account B to have explicit permission to assume the role in Account A, and the application must call STS AssumeRole to obtain temporary credentials.

Submitted by ngozi_ng· Mar 5, 2026Security

Question

A company stores all personally identifiable information (PII) in an Amazon DynamoDB table named PII in Account A. Developers are working on an application that is running on Amazon EC2 instances in Account B. The application in Account B requires access to the PII table. An administrator in Account A creates an IAM role named AccessPII that has permission to access the PII table. The administrator also creates a trust policy that specifies Account B as a principal that can assume the role. Which combination of steps should the developers take in Account B to allow their application to access the PII table? (Choose two.)

Options

  • AAllow the EC2 IAM role the permission to assume the AccessPII role.
  • BAllow the EC2 IAM role the permission to access the PII table.
  • CInclude the AWS API in the application code logic to obtain temporary credentials from the EC2
  • DInclude the AssumeRole API operation in the application code logic to obtain temporary
  • EInclude the GetSessionToken API operation in the application code logic to obtain temporary

How the community answered

(49 responses)
  • A
    65% (32)
  • B
    20% (10)
  • C
    10% (5)
  • E
    4% (2)

Why each option

Cross-account access requires the EC2 role in Account B to have explicit permission to assume the role in Account A, and the application must call STS AssumeRole to obtain temporary credentials.

AAllow the EC2 IAM role the permission to assume the AccessPII role.Correct

The EC2 instance profile in Account B must have an IAM policy granting sts:AssumeRole on the AccessPII role ARN; without this permission, the assume-role call will be denied even though Account A trusts Account B.

BAllow the EC2 IAM role the permission to access the PII table.

Granting the EC2 role direct access to the PII table in Account A is not possible via an Account B IAM policy; cross-account resource access to DynamoDB must go through role assumption.

CInclude the AWS API in the application code logic to obtain temporary credentials from the EC2

Retrieving credentials from the EC2 instance metadata service provides the EC2 instance's own role credentials, not credentials for the cross-account AccessPII role.

DInclude the AssumeRole API operation in the application code logic to obtain temporaryCorrect

The application code must invoke the STS AssumeRole API operation to exchange for temporary security credentials scoped to the AccessPII role; these credentials are then used to authenticate requests to the DynamoDB PII table in Account A.

EInclude the GetSessionToken API operation in the application code logic to obtain temporary

GetSessionToken is used to generate temporary credentials for an existing IAM identity (typically to satisfy MFA requirements), not to assume a role in a different account.

Concept tested: Cross-account IAM role assumption with STS

Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DVA-C02 Practice