Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company's security team is restricting access for a group of data analysts who currently hold full administrative permissions. The team wants to ensure the analysts can only read data from specific Amazon S3 buckets and run queries in Amazon Athena, following the principle of least privilege. Which of the following actions should the security team perform to meet these requirements? (Select TWO.)

  1. Create an IAM group for the analysts and attach an IAM policy that grants read-only access to S3 and query permissions for Athena.Answer
  2. Place the individual IAM users of the analysts into the new IAM group and remove any directly attached AdministratorAccess policies.Answer
  3. C
    Provide all analysts with the AWS account root user credentials and restrict their daily operations using a Service Control Policy (SCP).
  4. D
    Create a single shared IAM user with the required S3 and Athena permissions for all analysts to use to simplify credential management.
  5. E
    Submit a ticket to AWS Support to configure these access policies, as identity management configuration is a responsibility of AWS.

Answer

Creating a dedicated IAM group with a policy that allows only S3 and Athena access, and moving the analysts' individual IAM users into that group while removing their administrator policies.
The correct actions involve applying the principle of least privilege. By creating an IAM group with a policy restricted to the required Amazon S3 and Amazon Athena permissions, and placing individual IAM users into this group while stripping their admin rights, the company ensures that analysts have only the access necessary for their job functions. Managing access at the group level simplifies administration and aligns with AWS security best practices.

Step-by-Step Solution

1
Define the required permissions using an IAM policy that allows read-only access to Amazon S3 and query execution in Amazon Athena, and attach it to a newly created IAM group.
Access is grouped under a single administrative boundary corresponding to the analysts' job role.
Grouping permissions makes management easier and adheres to the principle of least privilege.
2
Assign the analysts' individual IAM users to the IAM group and detach any previously assigned direct policies, such as administrative access.
Analysts lose broad access and are restricted only to the permissions granted by the group policy.
This implements the transition to least privilege access controls safely.

Key Concept

Implementing the principle of least privilege using IAM users, groups, and policies under the AWS Shared Responsibility Model.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic