SAA-C03 · Question #810
A company uses AWS Organizations to manage multiple AWS accounts. The company needs to implement a secure, event-driven architecture in which specific Amazon Simple Notification Service (Amazon SNS)…
The correct answer is C. Modify the Amazon SQS queue policies in Account B to allow specific Amazon SNS topic. Modifying the SQS queue policy to allow only specific SNS topic ARNs from Account A ensures that messages can be published in a controlled, event-driven manner while adhering to the principle of least privilege. This approach grants only the necessary permissions without…
Question
A company uses AWS Organizations to manage multiple AWS accounts. The company needs to implement a secure, event-driven architecture in which specific Amazon Simple Notification Service (Amazon SNS) topics in Account A can publish messages to specific Amazon Simple Queue Service (Amazon SQS) queues in Account B. Which solution will meet these requirements while maintaining the principle of least privilege?
Options
- ACreate a new IAM role in Account A with permissions to publish to any Amazon SQS queue.
- BAdd the Amazon SNS topic Amazon Resource Names (ARNs) to Amazon SQS queue policies in
- CModify the Amazon SQS queue policies in Account B to allow specific Amazon SNS topic
- DCreate a shared IAM role across both accounts. Grant sns:Publish permissions to all Amazon
How the community answered
(39 responses)- A5% (2)
- B10% (4)
- C82% (32)
- D3% (1)
Explanation
Modifying the SQS queue policy to allow only specific SNS topic ARNs from Account A ensures that messages can be published in a controlled, event-driven manner while adhering to the principle of least privilege. This approach grants only the necessary permissions without overexposing resources.
Community Discussion
No community discussion yet for this question.