Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A university research laboratory is setting up an AWS account. The administrator needs to grant ten student researchers read-only access to a specific Amazon S3 bucket. Which of the following approaches represent AWS Identity and Access Management (IAM) best practices for this scenario? (Select two.)

  1. Create an individual IAM user for each student researcher.Answer
  2. Create an IAM group, attach the required permission policy to the group, and add the student users to it.Answer
  3. C
    Create a single IAM user account and share its credentials among all ten student researchers.
  4. D
    Share the AWS account root user's programmatic access keys with the student researchers.
  5. E
    Submit an AWS Support request to have AWS engineers configure access directly for the students' personal external identities.

Answer

The correct practices are to create an individual IAM user for each student researcher, and to manage their permissions collectively by creating an IAM group, attaching the permission policy to that group, and adding the users to the group.
Creating individual IAM users and organizing them into an IAM group to apply policies is the AWS-recommended approach. This pattern ensures clear auditing of actions while minimizing management overhead by applying policy controls at the group level.

Step-by-Step Solution

1
Analyze the access requirement.
Ten student researchers require S3 read-only access under administrative control.
To determine the appropriate identity and access strategy.
2
Apply IAM identity best practices.
Determine that sharing credentials or using the root user violates security principles, while creating individual IAM users and using IAM groups for permission management aligns with AWS best practices.
To ensure individual accountability, ease of management, and adherence to the principle of least privilege.

Key Concept

AWS IAM best practices emphasize using individual identities (IAM users) and grouping them (IAM groups) to simplify policy management, while strictly avoiding the use of shared accounts or the root user for daily activities.
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic