A company is onboarding a new team of data analysts who require read-only access to Amazon S3 buckets. Which of the following actions should the company take to configure access in accordance with AWS Identity and Access Management (IAM) best practices? (Select TWO.)
- Create individual IAM users for each analyst to ensure unique credentials and individual accountability.Answer
- Create an IAM group, attach the ReadOnlyS3 access policy to the group, and add the analyst users to the group.Answer
- CShare the AWS account root user credentials with all analysts to avoid individual account setup overhead.
- DGenerate a single set of long-term access keys for an IAM role and distribute them to all analysts.
- EConfigure AWS Support to manage and monitor daily access control policies for the analyst team.
Answer
Create individual IAM users for each analyst, and create an IAM group with read-only permissions to which the analysts are added.
The correct options are to create individual IAM users and to manage permissions via an IAM group. Creating individual users ensures auditability and security accountability. Using an IAM group allows you to define permissions (such as read-only access to S3) once and apply them to all members of the group, which aligns with AWS best practices for managing permissions at scale.
Step-by-Step Solution
Key Concept
Identity and Access Management (IAM) Best Practices