Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A healthcare startup stores encrypted patient records in a private Amazon S3 bucket in its production AWS account. An internal compliance officer (an IAM user in the same account) requires read-only access to these records for auditing. Simultaneously, an automated diagnostic application running in an external partner's AWS account must upload new patient reports directly to the same bucket. The startup's security policy prohibits sharing credentials or setting up cross-account identity federation. Which of the following configurations represents the most secure, AWS-recommended approach to grant the required access?

  1. A
    Create a new IAM user in the production AWS account for the external partner's application, generate static access keys, and share these credentials with the partner.
  2. B
    Rely on AWS to automatically authorize the compliance officer and the partner's external application based on their IP addresses, as all access routing is managed by AWS under the Shared Responsibility Model.
  3. Attach an identity-based policy to the compliance officer's IAM user granting read access, and attach a resource-based policy (bucket policy) to the S3 bucket granting write access to the partner's external AWS account.Answer
  4. D
    Generate access keys for the production AWS Account Root User and configure both the compliance officer and the partner's application to authenticate with them.

Answer

Attach an identity-based policy to the compliance officer's IAM user granting read access, and attach a resource-based policy (bucket policy) to the S3 bucket granting write access to the partner's external AWS account.
The correct answer is to attach an identity-based policy to the compliance officer's IAM user granting read access, and attach a resource-based policy (bucket policy) to the S3 bucket granting write access to the partner's external AWS account. Identity-based policies are optimal for managing access for users in the local account, while resource-based bucket policies are the most secure way to grant cross-account permissions directly without requiring the creation of local IAM users, the sharing of credentials, or the setup of full cross-account role assumption.

Step-by-Step Solution

1
Analyze the access requirements for the internal user.
The internal compliance officer is an IAM user in the same AWS account. An identity-based policy attached directly to the user (or their group) is the standard and most secure way to grant read access to S3.
Identity-based policies are designed to manage permissions for identities within the local account.
2
Analyze the access requirements for the external partner's application.
The application runs in an external AWS account. To grant cross-account access without sharing credentials, a resource-based S3 bucket policy should be configured to trust the external account's ARN or identity.
S3 bucket policies (resource-based) can directly grant cross-account access, eliminating the need to create IAM users or share long-term credentials.
3
Combine the configurations and evaluate best practices.
The combination of an identity-based policy for the internal user and a resource-based bucket policy for the external partner's application provides the most secure configuration while adhering to the principle of least privilege.
This avoids creating unnecessary IAM users with static keys or exposing root credentials, matching AWS security best practices.

Key Concept

Distinction between identity-based policies (attached to users/groups/roles) and resource-based policies (attached to resources like S3 buckets) for cross-account access.
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic