Q2 — AWS SAA-C03 Ch.11

Question 2 of 100 | ← Chapter 11

Q702. A development team is collaborating with another company to create an integrated product. The other company needs to access an Amazon Simple Queue Service (Amazon SQS) queue that is contained in the development team's account. The other company wants to poll the queue without giving up its own account permissions to do so.How should a solutions architect provide access to the SQS queue?

• A. Create an instance profile that provides the other company access to the SQS queue.
• B. Create an IAM policy that provides the other company access to the SQS queue.
• C. Create an SQS access policy that provides the other company access to the SQS queue. ✓
• D. Create an Amazon Simple Notification Service (Amazon SNS) access policy that provides the other company access to the SQS queue.

Correct Answer: C. Create an SQS access policy that provides the other company access to the SQS queue.

Explanation

To provide access to an Amazon Simple Queue Service (Amazon SQS) queue in the development team's account to another company without giving up its own account permissions, the recommended solution is:C. Create an SQS access policy that provides the other company access to the SQS queue. Option C provides a solution that allows the other company to access the SQS queue without requiring access to their own account permissions:- Create an SQS access policy: An access policy can be created specifically for the SQS queue to define granular permissions for the other company. The access policy can specify the necessary actions and resources that the other company needs to access within the queue.Option A, creating an instance profile, is not the recommended solution in this scenario. Instance profiles are used to grant AWS resources, such as EC2 instances, permissions to access other AWS services. They are not suitable for granting access to an external company.Option B, creating an IAM policy, is also not the recommended solution. IAM policies are used to manage permissions within an AWS account, but they do not provide a mechanism for granting access to resources in another account.Option D, creating an Amazon Simple Notification Service (Amazon SNS) access policy, is not the appropriate solution in this case. Amazon SNS is a messaging service used for pub/sub messaging, while the requirement is to provide access to an SQS queue. Although SQS can be integrated with SNS for event-driven messaging, it is not necessary or appropriate for this specific use case.Therefore, the best solution to provide access to the SQS queue to the other company without giving up its own account permissions is C: Create an SQS access policy that provides the other company access to the SQS queue. This allows for fine-grained control over the permissions granted to the other company specifically for the SQS queue.