An organization has just created a new AWS account and is planning its initial security and access control setup. The IT manager needs to secure the account access and configure day-to-day administrative privileges. Which of the following actions align with AWS security best practices for managing access in this scenario? (Select TWO.)
- Configure multi-factor authentication (MFA) on the root account and lock away its credentials, using it only for specific tasks that strictly require root privileges.Answer
- Generate distinct IAM identities for each IT administrator with administrative policies attached, ensuring they use these credentials for routine management tasks.Answer
- CDistribute the root account login details among the administrative staff to ensure they have unrestricted access for everyday tasks.
- DAssign permanent administrative IAM users to Amazon EC2 instances to run automated tasks instead of using temporary security credentials via roles.
- EAssume that AWS automatically secures the local operating systems and network settings of the administrators' devices under the Shared Responsibility Model.
Answer
Configuring multi-factor authentication (MFA) on the root account and restricting its usage, along with generating distinct IAM identities for each administrator for routine operations, are the recommended security practices.
Securing the root account with MFA and locking away its credentials ensures that the highest-privileged identity in the account is protected against unauthorized access. Creating individual IAM identities for daily administrative duties provides proper tracking, logging, and access control without exposing the root account.
Step-by-Step Solution
Key Concept
AWS Identity and Access Management (IAM) best practices focus on securing the root user with MFA and creating individual identities with appropriate permissions for daily operational tasks.