Examkin

Question

Difficulty: Very hardIdentity and Access Management (IAM)

A multi-department enterprise needs to grant a third-party auditing firm temporary, read-only access to specific AWS Billing reports and Amazon CloudTrail logs in their production AWS account. The auditing firm has its own AWS account. Which of the following approaches is the most secure and aligns with AWS Identity and Access Management (IAM) best practices to accomplish this?

  1. Create an IAM role in the enterprise account that trusts the auditing firm's AWS account, requiring an external ID, and attach a policy that grants read-only access to the billing and CloudTrail resources.Answer
  2. B
    Generate access keys for the enterprise account's root user and configure a strict IP-based policy to restrict the auditing firm's access to the enterprise's office network.
  3. C
    Create a dedicated IAM user in the enterprise account, assign permanent access keys to the auditing firm, and enable Multi-Factor Authentication (MFA) for the API access.
  4. D
    Open an AWS Support ticket requesting AWS to manage the secure transfer of billing data and CloudTrail logs to the auditing firm's account under the AWS Shared Responsibility Model.

Answer

Create an IAM role in the enterprise account that trusts the auditing firm's AWS account, requiring an external ID, and attach a policy that grants read-only access to the billing and CloudTrail resources.
The correct option correctly identifies using a cross-account IAM role with an external ID. An IAM role is designed for delegating secure access without needing to share long-term AWS credentials. The trust policy permits the third party's AWS account to assume the role, and the external ID prevents the confused deputy security issue.

Step-by-Step Solution

1
Evaluate identity delegation options for external third parties.
Determine that cross-account access using IAM roles is the secure path as it generates temporary credentials rather than using static access keys.
This minimizes the risk of credential leakage and simplifies access management by avoiding IAM user creation for external entities.
2
Apply the principle of least privilege and security mitigations.
Ensure the role has read-only permissions and utilizes an external ID in the trust policy.
Least privilege limits exposure, and the external ID mitigates the confused deputy security vulnerability in multi-tenant environments.

Key Concept

Delegating access to AWS resources using IAM roles for cross-account third-party entities
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic