A service assumes a role hourly and needs THAT SESSION restricted to read-only on a single bucket — narrower than the role's identity policy. How?
A.Edit the role's identity policy
Editing the role changes it for ALL sessions — not per-call restriction.
B.Pass a session policy in the AssumeRole call
Session policy = runtime narrowing. Correct.
C.Create a second role
A second role duplicates — session policy is lighter.
D.Use a permissions boundary
Boundaries are persistent caps — not per-session params.
Why this answer
Session policies are inline policies passed at AssumeRole time — effective session permissions = identity policy ∩ session policy. Purpose-built for per-session restriction without changing the role itself.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM Deep Dive practice session.
Practice IAM Deep Dive