AWS · SAP-C03
Least privilege and data perimeters
SAP-C03 · Lesson 12 of 28 · 1:44:00
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SAP-C03 exam (AWS Certified Solutions Architect – Professional). In this lesson: cross-account roles, external IDs, and session policies, permissions boundaries and ABAC, data perimeters with RCPs, SCPs, and VPC endpoint policies, and validating access with IAM Access Analyzer and Verified Access. Includes three original practice questions.
Preview the topics
- Developers must create IAM roles for their Lambda functions on their own, and no role that they create may ever have more permissions than the platform team allows. What should the architect configure?
- No identity outside the bank’s organization may ever reach its S3 buckets or KMS keys, even if one account writes a bucket policy that is too open. What should the architect apply?
- Contractors must open an internal loan application from their own laptops, without a VPN, and only when their identity and their device meet the bank’s requirements. What should the architect use?