Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A startup's systems administrator needs to perform a set of tasks: launching a new Amazon EC2 instance, configuring an IAM group for developers, modifying the contact information of the AWS account, and closing an unused AWS account. According to AWS security principles, which of these tasks must be performed by logging in as the AWS account root user?

  1. Modifying the primary account contact information and closing the unused AWS accountAnswer
  2. B
    Launching the new Amazon EC2 instance and configuring the developer IAM group
  3. C
    Delegating the account closure to an Amazon EC2 instance profile role by attaching an IAM policy with permanent API access keys
  4. D
    Requesting AWS Support to close the account and configure the developer IAM group

Answer

Modifying the primary account contact information and closing the unused AWS account
The correct option correctly identifies that modifying primary account contact information and closing an AWS account are among the few restricted tasks that require logging in as the AWS account root user. AWS recommends protecting the root user credentials and using them only for these specific actions.

Step-by-Step Solution

1
Analyze the administrative tasks to determine if they are daily operations or critical account lifecycle actions.
Launching EC2 instances and configuring IAM groups are identified as standard daily administrative tasks, while closing the account and changing primary contact information are account-level operations.
This separation helps identify where the principle of least privilege and root user protection rules apply.
2
Evaluate the permissions and capabilities of IAM identities (users, groups, and roles) versus the root user.
Daily administrative tasks can be fully managed using IAM policies attached to IAM users or groups. Account closure and primary credential/contact modifications are restricted exclusively to the root user.
AWS security best practices dictate that the root user should not be used for daily tasks, but is required for specific, high-risk account management tasks.
3
Verify if the task can be delegated to AWS Support under the Shared Responsibility Model.
AWS is responsible for security of the cloud, while the customer is responsible for security in the cloud, which includes account configurations and management. Thus, AWS Support cannot perform these tasks.
This confirms that the customer must perform these actions themselves using the appropriate account credentials.

Key Concept

AWS Root User vs IAM administrative users and roles
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic