Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company hires a new systems administrator who needs daily access to manage Amazon EC2 instances and Amazon RDS databases. Which of the following is the AWS-recommended best practice for granting this administrator access?

  1. A
    Configure access keys directly on the AWS account root user to allow the administrator full control of the resources.
  2. Create an individual IAM user for the administrator, attach policies granting only the necessary permissions, and require multi-factor authentication (MFA).Answer
  3. C
    Create a permanent IAM role with long-term security credentials and assign it to the administrator for daily AWS Management Console login.
  4. D
    Submit a support ticket requesting that AWS manage and patch the administrator's console credentials under the AWS shared responsibility model.

Answer

Create an individual IAM user for the administrator, attach policies granting only the necessary permissions, and require multi-factor authentication (MFA).
The correct approach is to create an individual IAM user with policies that grant only the required permissions for managing EC2 and RDS, and to secure the user with multi-factor authentication. This adheres to the principle of least privilege and ensures individual accountability.

Step-by-Step Solution

1
Identify the security requirements for daily administrative access to AWS resources.
Determine that the administrator needs specific access to EC2 and RDS, requiring individual credentials and multi-factor authentication.
Individual accountability and multi-factor authentication are core security practices.
2
Evaluate the options against AWS Identity and Access Management (IAM) best practices.
Determine that using individual IAM users with least privilege permissions meets these best practices, while avoiding the root user, permanent role login, or outsourcing IAM tasks to AWS.
This alignment ensures the account remains secure and follows the principle of least privilege.

Key Concept

IAM Best Practices for Daily Administration
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic