Close the vendor's role to everyone else
A hands-on CLF-C02 lab. You produce the real artefact and 8 automated checks verify it behaves the way the exam expects.
Try this labAll CLF-C02 practice
- Certification
- CLF-C02
- Format
- Structured configuration
- Difficulty
- medium
- Estimated time
- 12 min
- Automated checks
- 8
The brief
Repair trust-policy.json so only Beacon Cloud can assume the role. Keep the policy version at 2012-10-17 and leave exactly one Allow statement. Replace the wildcard principal with Beacon's account, arn:aws:iam::444455556666:root, and allow only sts:AssumeRole. Then add the condition that actually closes the role: a StringEquals check on sts:ExternalId set to the value Beacon issued for this account, Beacon-9f2ab1c4-7e30-4d55-8a61-2b0c9d7e4413. Use that value exactly - the vendor generates it and sends it on every call, so a value you invent will never match.
Part of CLF-C02 preparation
Labs are written by ExamNova to teach the decisions the exam tests. They are not reproductions of vendor lab content.