You want developers to create IAM roles for their Lambda functions but never grant those roles more permissions than a defined maximum. What enforces that ceiling?
A.Service control policy on the OU
SCPs bound all principals in an OU account — they can't specifically constrain which roles a developer creates.
B.Permissions boundary attached to the developer role
Correct. Boundaries are the delegated-administration mechanism: maximum permissions regardless of identity policies.
C.Resource-based policy on each Lambda
Resource policies grant access to a resource; they don't limit what a created role may do.
D.IAM policy simulator
The simulator evaluates policies — it doesn't enforce anything at runtime.
Why this answer
A permissions boundary caps the maximum permissions an identity-based policy can grant. Require the dev role to pass it when creating roles (aws:PermissionsBoundary condition) — created roles can never exceed the boundary.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM Deep Dive practice session.
Practice IAM Deep Dive