A company has a multi-account AWS environment that includes the following: - A central identity account that contains all IAM users and groups - Several member accounts that contain IAM roles A…

Question

Options

• AIn the member account, add sts:AssumeRole permissions to the role's policy. In the identity
• BIn the member account, add the group Amazon Resource Name (ARN) to the role's trust policy.
• CIn the member account, add the group Amazon Resource Name (ARN) to the role's trust policy.
• DIn the member account, add the group Amazon Resource Name (ARN) to the role's inline policy.

• A
  19% (6)
• B
  71% (22)
• C
  3% (1)
• D
  6% (2)

Explanation

Cross-account role assumption requires two explicit permissions. AWS CloudOps documentation states that the target role must trust the principal, and the principal must be allowed to call In the member account, the role's trust policy must list the IAM group ARN (or the identity account) as a trusted principal. In the identity account, the IAM group must have an inline or attached policy that allows the sts:AssumeRole action for the target role ARN. This dual configuration enables secure and controlled cross-account access.

No community discussion yet for this question.