A company wants to enhance its security by applying IAM permissions boundaries. The company tries to use IAM policy conditions and receives the following error: "Error: error updating IAM Role…

Question

Exhibit

Options

• AThe UpdateAssumeRolePolicy action is not compatible with the iam:PermissionsBoundary
• BCondition keys are not allowed in conjunction with permissions boundaries.
• CPermissions boundaries are not allowed with IAM policies.
• DIAM user id-arn is not allowed to assume role-name.

• A
  73% (30)
• B
  2% (1)
• C
  17% (7)
• D
  7% (3)

Explanation

Option A is correct because iam:PermissionsBoundary is a condition key that AWS only supports for specific IAM actions - specifically those that create or attach permissions boundaries (like iam:CreateRole, iam:PutRolePermissionsBoundary). The iam:UpdateAssumeRolePolicy action does not support this condition key, so when the condition is evaluated, it fails to match, resulting in an implicit deny and the 403 AccessDenied error. Option B is wrong because condition keys are broadly allowed with permissions boundaries - the issue is compatibility with a specific action, not conditions as a category. Option C is incorrect because permissions boundaries are absolutely a feature of IAM policies and work extensively with them. Option D is a misreading of the error - the error is about updating the assume role policy, not about assuming the role itself (which uses sts:AssumeRole).

Memory tip: Think of condition keys like power adapters - iam:PermissionsBoundary only fits into actions that set or attach boundaries; plug it into UpdateAssumeRolePolicy and it simply won't connect, killing the request silently with a deny.

No community discussion yet for this question.