Examkin

Question

Difficulty: Very hardIdentity and Access Management (IAM)

An organization needs to grant a third-party security auditing application read-only access to review configuration metadata across all AWS resources in their production account. To comply with the AWS Shared Responsibility Model and Identity and Access Management (IAM) security best practices, which configuration should the cloud administrator implement?

  1. Configure an IAM role with a trust policy that allows the third-party AWS account to assume it, specify an External ID, and attach the SecurityAudit managed policy.Answer
  2. B
    Create a dedicated IAM user with administrative access keys, configure Multi-Factor Authentication (MFA), and deliver the access keys securely to the third-party vendor.
  3. C
    Generate a set of temporary AWS account root user access keys specifically for the third-party application, and restrict the keys using a Service Control Policy (SCP).
  4. D
    Request that AWS Support establish a secure VPC peering connection to the third-party vendor to automatically authorize resource metadata synchronization.

Answer

Configure an IAM role with a trust policy that allows the third-party AWS account to assume it, specify an External ID, and attach the SecurityAudit managed policy.
The correct option outlines the standard AWS security best practice for third-party integrations: creating an IAM role that delegates access using temporary security credentials. The trust policy defines who can assume the role, and the External ID provides an additional security layer (preventing the confused deputy problem) specifically designed for third-party SaaS integrations. The SecurityAudit policy ensures read-only access to resource metadata.

Step-by-Step Solution

1
Determine the type of identity credential required for third-party SaaS integration.
Identify that an IAM role is required to establish secure cross-account delegation instead of creating a permanent IAM user or sharing root credentials.
Roles use temporary security credentials and are recommended for delegating access to external AWS accounts.
2
Select the appropriate trust mechanism and policy to ensure the principle of least privilege.
Create a trust policy specifying the third-party's AWS Account ID and an External ID, and attach a read-only policy such as SecurityAudit.
An External ID prevents the 'confused deputy' security vulnerability in multi-tenant SaaS environments, and the SecurityAudit policy ensures read-only metadata visibility.
3
Verify responsibility boundaries under the Shared Responsibility Model.
Confirm that the customer, not AWS Support, is responsible for executing this configuration.
Customer configuration of IAM identities, roles, and resource access policies is fully within the customer's domain of responsibility.

Key Concept

Delegating cross-account access to third-party integrations using IAM Roles and trust relationships.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic