Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company needs to grant an external auditor temporary access to view the configuration of their AWS resources. The auditor does not have an AWS account but has a corporate identity provider (IdP). Which of the following is the most secure AWS-recommended method to grant this access?

  1. A
    Create a long-term IAM user with read-only permissions and share the access keys with the auditor.
  2. B
    Share the AWS account root user credentials with the auditor for the duration of the audit.
  3. Configure identity federation to allow the auditor to assume an IAM role with read-only permissions using their corporate credentials.Answer
  4. D
    Submit a request to AWS Support to temporarily manage the auditor's access and monitor their activity.

Answer

Configure identity federation to allow the auditor to assume an IAM role with read-only permissions using their corporate credentials.
The correct option is to configure identity federation to allow the auditor to assume an IAM role. This mechanism enables secure single sign-on (SSO) using the auditor's existing corporate credentials and assigns temporary permissions via an IAM role. This removes the security risks associated with managing and storing permanent IAM credentials for external users.

Step-by-Step Solution

1
Identify the access requirement and the external user's identity source.
An external auditor needs temporary read-only access and has a corporate identity provider (IdP).
This establishes that the user is external and possesses an existing credential repository that can be integrated.
2
Apply the principle of least privilege and secure credential management.
Avoid creating static, long-term AWS credentials or sharing root access.
Creating permanent IAM users for temporary external audits or sharing root access violates fundamental AWS security principles.
3
Select the mechanism that maps the external identity provider to temporary AWS permissions.
Implement identity federation to assume an IAM role with read-only access.
Federation delegates authentication to the external IdP and provides temporary security credentials through an IAM role.

Key Concept

Identity Federation and IAM Roles for External Access
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic