Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A company has hired an external security auditing firm to inspect their AWS resource configurations. The auditors require read-only access to the AWS account for a limited period of two weeks. Which of the following options represents the AWS-recommended best practice to grant the external auditors access?

  1. A
    Create a permanent IAM user with read-only access and share the long-term username and password with the auditing team.
  2. Create an IAM role that allows the external auditors to assume it and obtain temporary security credentials.Answer
  3. C
    Share the AWS account root user credentials with the auditing firm to simplify access for the duration of the audit.
  4. D
    Submit a ticket to AWS Support requesting that AWS perform the security audit, as identity configuration and resource compliance are the sole responsibility of AWS.

Answer

Create an IAM role that allows the external auditors to assume it and obtain temporary security credentials.
The correct answer is to create an IAM role that the external auditors can assume. This is the AWS-recommended best practice because IAM roles generate temporary security credentials, minimizing the risk of credential exposure and avoiding the need to manage long-term credentials for external parties.

Step-by-Step Solution

1
Identify the access requirements for the external auditor.
The auditor requires read-only access for a limited time (two weeks).
This establishes that the access is temporary and delegated to an external entity.
2
Select the correct IAM entity type for temporary third-party access.
An IAM role is the appropriate entity because it grants temporary security credentials via role assumption.
IAM roles prevent the creation of permanent credentials and do not require sharing account credentials.

Key Concept

Delegating temporary access to third parties using IAM roles
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic