nerdexam
Amazon

SAA-C03 · Question #90

A company has an application that runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a U1 that uses Amazon DynamoDB and data services that u

The correct answer is A. Create separate IAM policies (or Amazon S3 and DynamoDB access with the required. The company needs to grant fine-grained, distinct AWS service access (DynamoDB for UI Pods, S3 for data service Pods) to specific EKS Pods using AWS IAM.

Submitted by manish99· Mar 4, 2026Design Secure Architectures

Question

A company has an application that runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a U1 that uses Amazon DynamoDB and data services that use Amazon S3 as part of the application deployment. The company must ensure that the EKS Pods for the U1 can access only Amazon DynamoDB and that the EKS Pods for the data services can access only Amazon S3. The company uses AWS Identity and Access Management |IAM). Which solution meets these requirements?

Options

  • ACreate separate IAM policies (or Amazon S3 and DynamoDB access with the required
  • BCreate separate IAM policies (or Amazon S3 and DynamoDB access with the required
  • CCreate separate Kubernetes service accounts for the U1 and data services to assume an IAM
  • DCreate separate Kubernetes service accounts for the U1 and data services to assume an IAM

How the community answered

(67 responses)
  • A
    82% (55)
  • B
    10% (7)
  • C
    3% (2)
  • D
    4% (3)

Why each option

The company needs to grant fine-grained, distinct AWS service access (DynamoDB for UI Pods, S3 for data service Pods) to specific EKS Pods using AWS IAM.

ACreate separate IAM policies (or Amazon S3 and DynamoDB access with the requiredCorrect

To provide fine-grained AWS service access to specific EKS Pods, separate Kubernetes service accounts should be created for the UI and data services. These service accounts are then associated with distinct IAM roles, each having a policy that grants access only to DynamoDB for the UI service account's role and only to S3 for the data service account's role, using the IAM Roles for Service Accounts (IRSA) pattern.

BCreate separate IAM policies (or Amazon S3 and DynamoDB access with the required

This option is identical to A. Assuming it's a typo in the provided options and A is the intended choice for the correct mechanism.

CCreate separate Kubernetes service accounts for the U1 and data services to assume an IAM
DCreate separate Kubernetes service accounts for the U1 and data services to assume an IAM

Concept tested: EKS IAM Roles for Service Accounts (IRSA), fine-grained access

Source: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAA-C03 Practice