A company has a multi-account AWS environment that includes the following: - A central identity account that contains all IAM users and groups - Several member accounts that contain IAM roles A…

Question

Options

• AIn the member account, add sts:AssumeRole permissions to the role's policy. In the identity
• BIn the member account, add the group Amazon Resource Name (ARN) to the role's trust policy.
• CIn the member account, add the group Amazon Resource Name (ARN) to the role's trust policy.
• DIn the member account, add the group Amazon Resource Name (ARN) to the role's inline policy.

• A
  12% (2)
• B
  76% (13)
• C
  6% (1)
• D
  6% (1)

Explanation

Option B is correct because cross-account role assumption requires a two-step configuration: the role's trust policy in the member account must explicitly allow the external principal to assume it, AND the group in the identity account must have an sts:AssumeRole permissions policy pointing to that role's ARN - both sides must agree for the assumption to succeed.

Option A is wrong because adding sts:AssumeRole only to the role's own permissions policy defines what the role can do after being assumed, not who is allowed to assume it - that's the trust policy's job.

Option D is wrong for the same reason - a role's inline policy governs the role's own permissions, not the trust relationship; modifying it does nothing to allow an external principal to assume the role.

Option C (as presented here, identical to B) is likely a duplicate/formatting artifact in this question rendering; in the actual exam, the distractor would differ by omitting the identity account step or specifying the wrong policy type.

Memory tip: Think of it as a two-way handshake - the role must say "I trust you" (trust policy in member account) and the group must say "I have permission to knock" (sts:AssumeRole in identity account). Both doors must be open.

No community discussion yet for this question.