Examkin

Question

Difficulty: Very hardIdentity and Access Management (IAM)

A developer using an IAM user in a development account (Account A) requires temporary access to perform administrative tasks on an Amazon DynamoDB table located in a production account (Account B). To adhere to AWS security best practices and the principle of least privilege, which of the following configuration steps must be implemented? (Select TWO.)

  1. In the production account (Account B), create an IAM role with a trust policy that allows the IAM user in the development account (Account A) to assume the role.Answer
  2. In the development account (Account A), attach an identity-based policy to the developer's IAM user that allows the sts:AssumeRole action targeting the role in Account B.Answer
  3. C
    In the production account (Account B), configure the AWS Account Root User to grant temporary administrative privileges directly to the developer's identity.
  4. D
    In the development account (Account A), configure a resource-based policy directly on the developer's IAM user to permit inbound administrative access from Account B.
  5. E
    In the production account (Account B), create a new IAM user with administrative credentials and save their long-term access keys in the development account's shared configuration files.

Answer

To establish secure cross-account access, you must create an IAM role in the production account (Account B) with a trust policy that permits the development account user to assume it, and attach an identity-based policy in the development account (Account A) allowing the user to call the sts:AssumeRole action on the production role.
The correct steps require establishing trust between the two accounts using an IAM role and granting the user permissions to assume that role. Creating an IAM role in the destination account with a trust policy defines who can assume the role. Attaching an identity-based policy in the source account allowing the sts:AssumeRole action gives the source user the ability to request the role's temporary credentials. This combination enables secure cross-account access without using permanent credentials.

Step-by-Step Solution

1
Configure trust in the target account
An IAM role is created in the production account (Account B) with a trust policy specifying the AWS account ID or specific IAM user ARN of the development account (Account A) as the trusted principal.
This establishes that the production account trusts the development account's identity to assume the role.
2
Grant delegation permission in the source account
An IAM policy is attached to the IAM user or group in the development account (Account A) containing an 'Allow' effect for the 'sts:AssumeRole' action on the target role's ARN.
This permits the IAM user in Account A to execute the API call required to assume the role and retrieve temporary credentials.

Key Concept

Cross-account access delegation using IAM roles and temporary security credentials
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic