You are an AWS solutions architect in a large IT company, and your company has owned several AWS accounts. By using IAM roles, access to resources in other accounts is granted. For example, users in the Test account may switch roles and operate on DynamoDB resources that belong to the Dev account.

Answer options:

A.The user is signed in as the AWS account non-root user.
B.The assuming entity has used multi-factor authentication (MFA) protection.
C.The target account that the user plans to switch to must use an alias.
D.The user must be explicitly granted permission to assume the role.

Correct Answer – A, D
The below diagram is a reference on how to switch roles between accounts.
Option A is CORRECT because you cannot switch to a role when you are signed in as the AWS account root user. This is indicated in
https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html.
Option B is incorrect: Because multi-factor authentication (MFA) is optional when a role is created.
Option C is incorrect because the alias of the target account is optional. During role switch, the user specifies the account ID (or alias) and role name.
Option D is CORRECT because it is required for the user to have permission to assume the role that belongs to other accounts.