Examkin

Question

Difficulty: Very hardIdentity and Access Management (IAM)

A company needs to restrict its database administrators from modifying Amazon RDS instances when they are working outside of the corporate network or outside of standard business hours. Which IAM mechanism should the security team implement to enforce these specific access conditions?

  1. An IAM policy containing a Condition element with aws:SourceIp and aws:CurrentTime keys attached to the database administrators' role or groupAnswer
  2. B
    A trust policy attached directly to the Amazon RDS database instances that defines the allowed access hours and IP address ranges
  3. C
    A configuration applied to the AWS Account Root User that automatically disables database administrator API access keys during off-hours
  4. D
    An AWS-managed service control setting that relies on the AWS Shared Responsibility Model to dynamically block console access based on the administrator's physical timezone

Answer

An IAM policy containing a Condition element with aws:SourceIp and aws:CurrentTime keys attached to the database administrators' role or group
The correct answer is the option that suggests using an IAM policy with a Condition element containing the aws:SourceIp and aws:CurrentTime keys. This allows the security team to specify exactly when and from where the policy permits database administration tasks, conforming to best practices.

Step-by-Step Solution

1
Analyze the access control requirements
Identify that the restrictions are based on network location (IP address) and request time (business hours).
This determines which variables or policy attributes must be evaluated during policy execution.
2
Evaluate the capabilities of IAM Policy elements
Determine that the 'Condition' block in IAM JSON policies allows specifying conditions under which the policy statement is in effect, using global condition keys like 'aws:SourceIp' and 'aws:CurrentTime'.
This matches the exact parameters of the requirement (network source and time constraints).
3
Apply the policy to the appropriate identity
Attach the policy containing these conditions to the IAM group or role used by database administrators.
Attaching the policy directly to the identity ensures that all administrative requests made by those users are evaluated against these rules.

Key Concept

IAM Policy Conditions
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic