SCS-C02 · Question #94
A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The auditor is having…
The correct answer is A. The external ID used by the auditor is missing or incorrect. C. The auditor has not been granted sts:AssumeRole for the role in the destination account. F. The role ARN used by the auditor is missing or incorrect. Cross-account IAM role assumption via STS can fail due to incorrect external ID, missing AssumeRole permission, or an incorrect role ARN, all of which prevent the sts:AssumeRole API call from succeeding.
Question
A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The auditor is having trouble accessing some of the accounts. Which of the following may be causing this problem? (Choose three.)
Options
- AThe external ID used by the auditor is missing or incorrect.
- BThe auditor is using the incorrect password.
- CThe auditor has not been granted sts:AssumeRole for the role in the destination account.
- DThe Amazon EC2 role used by the auditor must be set to the destination account role.
- EThe secret key used by the auditor is missing or incorrect.
- FThe role ARN used by the auditor is missing or incorrect.
How the community answered
(32 responses)- A81% (26)
- B3% (1)
- D3% (1)
- E13% (4)
Why each option
Cross-account IAM role assumption via STS can fail due to incorrect external ID, missing AssumeRole permission, or an incorrect role ARN, all of which prevent the sts:AssumeRole API call from succeeding.
When a trust policy requires an external ID condition, providing a missing or incorrect external ID causes the AssumeRole call to fail with an access denied error.
IAM role assumption uses STS tokens and does not involve passwords; passwords are used only for AWS Management Console sign-in with IAM users.
The auditor's IAM principal must have an explicit sts:AssumeRole permission for the target role ARN; without it, the call is rejected regardless of the trust policy.
An EC2 instance role is used to assume roles within its account context but does not need to be set to a destination role; AssumeRole is called explicitly via STS.
Secret access keys authenticate an IAM user or role session but are not directly checked during AssumeRole for cross-account trust; the trust policy and permission policy govern access.
The role ARN uniquely identifies the target role; an incorrect or missing ARN means the AssumeRole request references a non-existent or wrong resource and fails.
Concept tested: STS AssumeRole cross-account access requirements
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html
Topics
Community Discussion
No community discussion yet for this question.