Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company wants to integrate a third-party security auditing application that runs on an external, non-AWS platform. The application requires read-only access to the company's AWS resource configurations. Which of the following is the AWS-recommended best practice to grant this access securely?

  1. Create an IAM role with a trust policy that allows the third-party account to assume it, and attach a read-only policy to the role.Answer
  2. B
    Generate access keys for the AWS account root user and share them with the third-party vendor to ensure comprehensive access.
  3. C
    Create a dedicated IAM user, generate long-term access keys, and share these credentials directly with the third-party vendor.
  4. D
    Contact AWS Support and request that they modify the physical data center firewall to allow the external application's IP address to bypass AWS authentication.

Answer

Create an IAM role with a trust policy that allows the third-party account to assume it, and attach a read-only policy to the role.
Creating an IAM role with a trust policy is the secure and recommended way to grant access to third-party accounts or external applications. It allows the external service to temporarily assume the role and access the necessary resources, ensuring that no long-term credentials (like passwords or access keys) are shared or stored externally.

Step-by-Step Solution

1
Analyze the access requirement
The external third-party application requires read-only access to AWS resource configurations without introducing permanent credential risks.
Security best practices dictate minimizing permanent credential exposure and using temporary access methods.
2
Evaluate role-based access vs user-based access
IAM roles provide temporary credentials using security token services, whereas IAM users use long-term credentials.
An IAM role is designed for cross-account or external service access delegation without exposing long-term keys.
3
Select the correct AWS recommendation
Create an IAM role with a trust relationship defining who can assume the role, and apply a permission policy containing read-only access.
This implements the principle of least privilege and avoids sharing permanent credentials.

Key Concept

Delegating AWS resource access to third-party applications using temporary credentials via IAM roles.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic