Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

An enterprise wants to allow a third-party SaaS monitoring application to collect performance metrics from Amazon CloudWatch in their AWS account. The SaaS provider's application runs in its own AWS account. The solutions architect must configure this access securely following the principle of least privilege, preventing unauthorized access by other customers of the SaaS provider.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create an IAM role in the enterprise account with a trust policy that trusts the SaaS provider's AWS account and requires a unique External IDAnswer
  2. Attach a permissions policy to the IAM role that grants read-only access to Amazon CloudWatch metricsAnswer
  3. C
    Create an IAM user in the enterprise account, assign CloudWatch read-only permissions, and share the user's access keys with the SaaS provider
  4. D
    Share the enterprise account's root user access keys with the SaaS provider to ensure unrestricted access to all metrics
  5. E
    Store the API tokens and credentials used by the SaaS agent as a plaintext parameter in AWS Systems Manager Parameter Store

Answer

To securely grant access to the third-party SaaS monitoring application, the solutions architect should create an IAM role in the enterprise account with a trust policy that requires a unique External ID and trusts the SaaS provider's AWS account. Additionally, a permissions policy granting read-only access to Amazon CloudWatch metrics must be attached to this role.
The correct combination of steps involves creating an IAM role in the enterprise account that trusts the third-party's AWS account and enforces an External ID, and then attaching a CloudWatch read-only permissions policy to that role. This enables secure cross-account delegation of access without using long-term credentials and prevents the confused deputy security vulnerability.

Step-by-Step Solution

1
Identify the correct cross-account access mechanism.
Determine that an IAM role with cross-account access is preferred over long-term credentials.
Using roles eliminates the need to manage and share long-term credentials like access keys.
2
Secure the trust relationship for the role.
Specify the third party's AWS account ID in the trust policy and require a unique External ID.
The External ID mitigates the confused deputy problem when a third party accesses multiple customer accounts.
3
Apply the principle of least privilege.
Attach a permissions policy to the IAM role that only allows read-only access to CloudWatch metrics.
This ensures that the monitoring application can only access the metrics it needs and cannot perform administrative changes.

Key Concept

Cross-account access using IAM roles and External IDs to secure third-party integration.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic