DVA-C02 · Question #777
A company uses an organization in AWS Organizations to manage a multi-account landing zone. The company has enabled service control policies (SCP) and resource control policies (RCPs) on the…
The correct answer is C. Create a role named TimesheetAnalyticsRole in Account A that has the dynamodb:Query E. Create a resource-based policy on the EmployeeTimesheetEntries table that allows the. The application in Account A needs an identity-based permission that allows it to call DynamoDB Query against the target table, which is provided by creating a role in Account A with the required dynamodb:Query permission. To allow cross-account access to the DynamoDB table in…
Question
A company uses an organization in AWS Organizations to manage a multi-account landing zone. The company has enabled service control policies (SCP) and resource control policies (RCPs) on the organization. A developer is building a new analytics application to deploy in Account A. The application needs to query an Amazon DynamoDB table named EmployeeTimesheetEntries in Account B. Which combination of steps will meet these requirements? (Choose two.)
Options
- ACreate a role named TimesheetAnalyticsRole in Account B that has the dynamodb:Query
- BCreate an SCP attached to Account A that allows the dynamodb:Query permission for the
- CCreate a role named TimesheetAnalyticsRole in Account A that has the dynamodb:Query
- DCreate an RCP attached to Account A that allows the dynamodb:Query permission for the
- ECreate a resource-based policy on the EmployeeTimesheetEntries table that allows the
How the community answered
(20 responses)- A5% (1)
- B10% (2)
- C60% (12)
- D25% (5)
Explanation
The application in Account A needs an identity-based permission that allows it to call DynamoDB Query against the target table, which is provided by creating a role in Account A with the required dynamodb:Query permission. To allow cross-account access to the DynamoDB table in Account B, the table must also explicitly trust that role by using a resource-based policy on the EmployeeTimesheetEntries table that permits dynamodb:Query from the role in Account A.
Community Discussion
No community discussion yet for this question.