Certain users from your team need to assume an IAM role called AppAdminAccess for some configuration tasks. When they use the role, they know the specific actions that are required. You want to restrict the permissions when the role is assumed so that only specific actions can be performed in the role session. How would you achieve this requirement?

Answer options:

A.Pass a session policy with AssumeRole API to limit the permissions.
B.Attach an IAM policy to the IAM users to limit their permissions.
C.Configure a permission boundary to the IAM users to control their maximum permissions.
D.This cannot be done using AssumeRole API. Create a new IAM role with the required permissions.

Correct Answer – A
Option A is CORRECT: Because the AssumeRole API can add a session policy parameter to limit the total permissions granted by the assumed IAM role.
Option B is incorrect: Because the IAM policy of the IAM users cannot limit the permissions when an IAM role is assumed.
Option C is incorrect: Because the permission boundary does not influence the permissions when IAM users assume an IAM role.
Option D is incorrect: Because there is no need to create a new IAM role since users can pass the session policy in the AssumeRole API.
Reference:
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session