Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A software startup wants to allow a third-party vendor to run automated test suites against resources in its AWS development account. The vendor requires programmatic access for a limited time, and the startup must ensure that no long-term credentials are shared or stored. Which of the following is the most secure AWS-recommended method to grant this access?

  1. A
    Create a permanent IAM user with administrator permissions and share the access keys with the vendor.
  2. B
    Generate and share access keys from the AWS account root user to ensure the vendor has full access to run any test.
  3. Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.Answer
  4. D
    Submit a support ticket requesting that the AWS Support team run the testing suite within the customer's environment.

Answer

Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.
The correct answer is to create an IAM role. IAM roles allow external entities to assume permissions and receive temporary security credentials via the AWS Security Token Service (STS). This avoids the need to distribute or manage long-term secrets, fulfilling the requirement of temporary access securely.

Step-by-Step Solution

1
Identify the key requirements of the scenario.
The third-party vendor requires programmatic access for a limited time, and credentials must not be long-term or shared.
This establishes that the solution must support temporary access without sharing permanent credentials.
2
Compare the security mechanisms of IAM users, roles, and the root user.
IAM users and root users utilize long-term credentials, whereas IAM roles issue temporary credentials that expire automatically.
Choosing the correct IAM entity ensures adherence to AWS security best practices.
3
Verify ownership and operational boundaries under the Shared Responsibility Model.
Executing scripts and configuring access is a customer-side responsibility, ruling out direct management by AWS Support.
This eliminates options that assume AWS manages tenant-level operational tasks.

Key Concept

Using IAM roles for temporary, cross-account, or third-party access instead of sharing long-term credentials.
Estimated Time:1m 15s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic