Examkin

Question

Difficulty: HardIAM Policies and Roles

A developer is integrating a third-party SaaS monitoring platform with their company's AWS account. The SaaS platform runs in AWS Account 123456789012123456789012 and needs to assume an IAM role in the developer's AWS Account 987654321098987654321098 to retrieve CloudWatch metric data. To prevent the confused deputy problem, the SaaS platform requires the developer to configure an External ID of `SaaS-Monitor-99x`.

Which two actions must the developer perform to establish this cross-account access securely? (Select TWO.)

  1. Create an IAM role with a trust policy that allows the `sts:AssumeRole` action, designates the principal as `arn:aws:iam::123456789012:root`, and contains a condition block that checks if `sts:ExternalId` matches `SaaS-Monitor-99x`.Answer
  2. Attach an identity-based permissions policy to the IAM role that allows the `cloudwatch:GetMetricData` and `cloudwatch:ListMetrics` actions.Answer
  3. C
    Create an IAM role with a trust policy that designates the principal as the AWS service principal `monitoring.amazonaws.com` and includes the External ID condition.
  4. D
    Configure a resource-based policy on the CloudWatch metric namespaces to allow the SaaS platform's IAM role to perform the `sts:AssumeRole` action.
  5. E
    Hardcode the AWS access keys of an IAM user created in the developer's account directly inside the SaaS platform's client configuration.

Answer

To securely configure cross-account access, the developer must create an IAM role with a trust policy that allows the `sts:AssumeRole` action for the external AWS account principal with a condition checking the External ID, and attach an identity-based permissions policy to the role that allows the necessary CloudWatch actions.
Establishing cross-account access for a third-party application requires creating an IAM role in the trusting account. The trust policy of this role must specify the external account ID as the principal and allow the `sts:AssumeRole` action. To prevent the confused deputy problem, a condition block must enforce the `sts:ExternalId` provided by the third-party. Additionally, the role itself must have an identity-based permissions policy attached to it that defines what AWS APIs the assumed role can call (specifically the CloudWatch metric retrieval APIs).

Step-by-Step Solution

1
Analyze the requirements for cross-account access and security constraints.
Identify that the third-party application operates in AWS Account 123456789012123456789012, requires access to CloudWatch metrics in AWS Account 987654321098987654321098, and requires the mitigation of the confused deputy problem using an External ID.
This establishes the parameters needed to configure the IAM role trust policy and permission policies.
2
Configure the trust policy of the IAM role to grant assume-role permission to the external account.
Define a trust policy allowing `sts:AssumeRole` with principal `arn:aws:iam::123456789012:root` and a condition block validating that `sts:ExternalId` is `SaaS-Monitor-99x`.
The trust policy establishes which entity can assume the role and validates the External ID to secure the delegation.
3
Configure the permissions policy of the IAM role to grant access to the required resources.
Define an identity-based policy allowing `cloudwatch:GetMetricData` and `cloudwatch:ListMetrics` actions, and attach it to the role.
The permissions policy defines the API operations the external entity is authorized to execute after assuming the role.

Key Concept

Establishing secure cross-account delegation via IAM roles, trust policies, and External IDs to prevent the confused deputy problem.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic