Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A software development firm manages a multi-account AWS environment. A developer in the development account needs temporary administrative access to perform emergency troubleshooting on resources in the production account. Which of the following options represents the most secure, AWS-recommended method to achieve this?

  1. A
    Create a dedicated IAM user in the production account with administrative permissions, and configure the developer's development tools with these static credentials.
  2. Create an IAM role in the production account with a trust policy that allows the development account to assume it, and grant the developer permission to assume this role.Answer
  3. C
    Enable multi-factor authentication (MFA) on the production account's root user, and share the root user credentials with the developer for temporary troubleshooting access.
  4. D
    Do not configure permissions, as AWS automatically manages cross-account resource access under the infrastructure security portion of the AWS Shared Responsibility Model.

Answer

Create an IAM role in the production account with a trust policy that allows the development account to assume it, and grant the developer permission to assume this role.
The correct method is to create an IAM role in the production account that trusts the development account, and then allow the developer to assume this role. This approach follows the security best practice of using temporary credentials (via AWS STS) for cross-account delegation, eliminating the need to create static credentials or duplicate users across multiple accounts.

Step-by-Step Solution

1
Evaluate the need for cross-account access and identify the appropriate IAM entity.
Determine that IAM roles are designed to delegate access to resources across different AWS accounts using temporary credentials.
IAM roles allow users in one account to assume permissions in another account securely without creating duplicate IAM users or sharing static keys.
2
Configure the trust policy of the target IAM role in the production account.
Define a trust policy that specifies the development account ID as a trusted principal.
This establishes a cryptographic trust relationship, allowing users in the trusted development account to assume the role.
3
Grant the developer permission to assume the cross-account role.
Attach an IAM policy to the developer's IAM user or group in the development account that allows the sts:AssumeRole action on the production role's ARN.
The developer must have explicit permission to request the temporary credentials from AWS STS.

Key Concept

Cross-account access delegation using IAM roles and temporary security credentials.
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic