nerdexam
Amazon

SAA-C03 · Question #605

A company has an Amazon S3 bucket that contains sensitive data files. The company has an application that runs on virtual machines in an on-premises data center. The company currently uses AWS IAM Ide

The correct answer is B. Use IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to. To securely grant temporary access to an S3 bucket for an on-premises application that uses AWS IAM Identity Center, implementing IAM Roles Anywhere is the most appropriate solution.

Submitted by brentm· Mar 4, 2026Design Secure Architectures

Question

A company has an Amazon S3 bucket that contains sensitive data files. The company has an application that runs on virtual machines in an on-premises data center. The company currently uses AWS IAM Identity Center. The application requires temporary access to files in the S3 bucket. The company wants to grant the application secure access to the files in the S3 bucket. Which solution will meet these requirements?

Options

  • ACreate an S3 bucket policy that permits access to the bucket from the public IP address range of
  • BUse IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to
  • CInstall the AWS CLI on the virtual machine. Configure the AWS CLI with access keys from an IAM
  • DCreate an IAM user and policy that grants access to the bucket. Store the access key and secret

How the community answered

(51 responses)
  • A
    8% (4)
  • B
    73% (37)
  • C
    4% (2)
  • D
    16% (8)

Why each option

To securely grant temporary access to an S3 bucket for an on-premises application that uses AWS IAM Identity Center, implementing IAM Roles Anywhere is the most appropriate solution.

ACreate an S3 bucket policy that permits access to the bucket from the public IP address range of

An S3 bucket policy based on public IP addresses grants static access based on network location, which is less secure, difficult to manage for dynamic IPs, and does not provide temporary, identity-based credentials.

BUse IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access toCorrect

IAM Roles Anywhere enables on-premises workloads, such as applications running on virtual machines in a data center, to obtain temporary AWS security credentials. By integrating with existing Public Key Infrastructure (PKI) and IAM Identity Center, the application can authenticate and assume an IAM role, gaining secure, temporary access to the S3 bucket without requiring long-term AWS credentials to be stored on-premises.

CInstall the AWS CLI on the virtual machine. Configure the AWS CLI with access keys from an IAM

Installing the AWS CLI and configuring it with access keys from an IAM user relies on long-lived static credentials, which is a security anti-pattern and does not meet the requirement for *temporary* access.

DCreate an IAM user and policy that grants access to the bucket. Store the access key and secret

Creating an IAM user with long-lived access keys and storing them on the virtual machine is highly insecure and violates best practices for granting temporary and managed access to AWS resources.

Concept tested: Secure temporary access for on-premises workloads using IAM Roles Anywhere

Source: https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAA-C03 Practice