Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A software-as-a-service (SaaS) provider needs to periodically analyze resource configurations stored in an Amazon S3 bucket within a customer's AWS account. The customer wants to grant this access to the provider's AWS account securely without creating or exchanging permanent IAM credentials. Which of the following is the AWS-recommended best practice to achieve this?

  1. A
    Create a dedicated IAM user with programmatic access, attach an S3 read-only policy, and share the access key ID and secret access key with the provider.
  2. B
    Establish an AWS Direct Connect connection between the provider and customer networks to automatically authorize data access based on physical port security.
  3. Create an IAM role with a trust policy that allows the provider's AWS account to assume it, and attach a permissions policy that grants read-only access to the S3 bucket.Answer
  4. D
    Generate temporary security credentials using the customer account's root user and configure the provider's applications to use these root credentials.

Answer

Create an IAM role with a trust policy that allows the provider's AWS account to assume it, and attach a permissions policy that grants read-only access to the S3 bucket.
The most secure method is to create an IAM role in the customer's account that trusts the provider's AWS account. This role has a trust policy allowing the provider to assume it and a permissions policy that grants read-only S3 access. This setup uses short-lived, temporary security credentials and avoids the exchange of long-term credentials.

Step-by-Step Solution

1
Identify the security requirement for cross-account resource access without long-term credentials.
Determine that temporary credentials and delegation of access to an external AWS account are required.
AWS recommends delegating access using temporary security credentials (IAM roles) rather than sharing permanent access keys or root credentials.
2
Create an IAM role in the trusting account (the customer's account).
An IAM role is defined with a trust policy specifying the trusted entity (the SaaS provider's AWS account ID) and a permissions policy allowing read-only access to the S3 bucket.
The trust policy enables the external account to assume the role, while the permissions policy enforces the principle of least privilege.
3
Allow the external provider to assume the role.
The SaaS provider assumes the role using AWS Security Token Service (STS) to obtain short-lived credentials for S3 access.
This eliminates the need to manage, rotate, or risk leaking long-term credentials.

Key Concept

IAM Roles for cross-account access provide a secure way to grant third-party entities access to AWS resources using temporary security credentials instead of sharing long-term IAM user credentials or root account details.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic