Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company needs to grant an external auditing firm temporary, read-only access to the AWS CloudTrail logs stored in their AWS account. The access must expire automatically after a set period. Which configuration should the company use to grant this access according to AWS security best practices?

  1. A
    Create a permanent IAM user with access keys for the auditing firm and delete the user when the audit is complete.
  2. B
    Submit a request to AWS Support to grant the external firm access to the logs on the company's behalf.
  3. Create an IAM role with a read-only policy that the auditing firm can assume.Answer
  4. D
    Share the AWS account root user login credentials and change the password after the audit ends.

Answer

Create an IAM role with a read-only policy that the auditing firm can assume.
Creating an IAM role with a read-only policy is the correct approach. IAM roles do not have permanent credentials; instead, they provide temporary security credentials that expire automatically, which satisfies the requirement for temporary, time-limited access without the risk of long-term credentials.

Step-by-Step Solution

1
Analyze the requirements for external access.
The external auditing firm requires read-only access to AWS CloudTrail logs, and the access must be temporary and automatically expire.
This establishes the constraints of the required solution: read-only permissions and temporary credentials.
2
Evaluate the AWS Identity and Access Management (IAM) entities.
IAM roles provide temporary security credentials that rotate automatically and expire, which matches the need for temporary access. IAM users, by contrast, rely on long-term credentials like passwords or access keys, which are not suitable for temporary third-party access.
This identifies the correct mechanism to fulfill the temporary access requirement while adhering to security best practices.
3
Verify compliance with the Shared Responsibility Model and root user best practices.
Sharing root user credentials is a major security violation, and asking AWS Support to manage access permissions violates the customer's responsibility for security 'in' the cloud. Configuring an IAM role is the customer's responsibility and aligns with best practices.
This confirms that alternative options violate fundamental AWS security and responsibility principles.

Key Concept

AWS IAM Roles for Temporary Access
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic