Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An administrator has created a new AWS account to host a student portal. To align with AWS security best practices, which action should the administrator perform first regarding the AWS account root user?

  1. A
    Create a single shared IAM user with administrative privileges and share its password among all students.
  2. Enable multi-factor authentication (MFA) for the root user and create individual IAM users with administrative permissions for daily tasks.Answer
  3. C
    Generate an access key ID and secret access key for the root user to integrate with the portal's deployment scripts.
  4. D
    Configure AWS Support to automatically rotate the root user password every 30 days.

Answer

Enable multi-factor authentication (MFA) for the root user and create individual IAM users with administrative permissions for daily tasks.
Enabling multi-factor authentication (MFA) for the root user secures the most privileged identity in the AWS account. Daily administrative tasks should be performed by IAM users with appropriate permissions rather than the root user, following the principle of least privilege.

Step-by-Step Solution

1
Identify the security requirements for the root user of a new AWS account.
The root user has complete, unrestricted access to all resources and billing, making its protection paramount.
Understanding the privilege level of the root user highlights the need for immediate securing steps (like MFA) and avoiding daily usage.
2
Compare the proposed actions against AWS security best practices.
Creating individual IAM users with limited or administrative rights for daily tasks and securing the root account with MFA is the recommended path.
This setup limits the risk of exposing root credentials and ensures compliance with the principle of least privilege.

Key Concept

AWS account root user security best practices dictate that the root user should not be used for daily tasks, must be protected by MFA, and daily administration should be delegated to individual IAM users.
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic