nerdexam
Amazon

SAA-C03 · Question #152

A company wants to provide a third-party system that runs in a private data center with access to its AWS account. The company wants to call AWS APIs directly from the third-party system. The…

The correct answer is D. IAM Roles Anywhere: Enables AWS API access using X.509 certificates without long-term. The company needs to grant a third-party on-premises system AWS API access securely using existing digital certificates, without long-term AWS credentials, SAML, or OIDC.

Submitted by devops_kid· Mar 4, 2026Design Secure Architectures

Question

A company wants to provide a third-party system that runs in a private data center with access to its AWS account. The company wants to call AWS APIs directly from the third-party system. The company has an existing process for managing digital certificates. The company does not want to use SAML or OpenID Connect (OIDC) capabilities and does not want to store long-term AWS credentials. Which solution will meet these requirements?

Options

  • AMutual TLS: Provides secure communication but does not integrate with AWS credential
  • BAWS Signature v4: Requires direct integration with AWS and is less secure for external
  • CKerberos: Not natively supported for AWS API authentication.
  • DIAM Roles Anywhere: Enables AWS API access using X.509 certificates without long-term

How the community answered

(26 responses)
  • A
    8% (2)
  • B
    15% (4)
  • C
    4% (1)
  • D
    73% (19)

Why each option

The company needs to grant a third-party on-premises system AWS API access securely using existing digital certificates, without long-term AWS credentials, SAML, or OIDC.

AMutual TLS: Provides secure communication but does not integrate with AWS credential

Mutual TLS (mTLS) provides secure communication channels but is not an authentication mechanism for AWS APIs by itself; it would still require an underlying method to obtain AWS credentials, which is what IAM Roles Anywhere provides with certificates.

BAWS Signature v4: Requires direct integration with AWS and is less secure for external
CKerberos: Not natively supported for AWS API authentication.
DIAM Roles Anywhere: Enables AWS API access using X.509 certificates without long-termCorrect

IAM Roles Anywhere enables on-premises servers to obtain temporary AWS credentials by authenticating with their X.509 certificates issued by a trusted Certificate Authority. This solution integrates with existing certificate management processes, eliminates the need for long-term AWS credentials on the third-party system, and avoids SAML/OIDC, meeting all specified requirements.

Concept tested: AWS API access for on-premises, IAM Roles Anywhere

Source: https://aws.amazon.com/iam/roles-anywhere/

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAA-C03 Practice