Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company needs to grant an external compliance audit firm temporary access to audit logs stored in a private Amazon S3 bucket. The audit firm has its own AWS account. The company wants to ensure that the audit firm can access the logs securely without sharing long-term AWS credentials, adhering to the principle of least privilege. Which solution should a solutions architect recommend to meet these requirements?

  1. A
    Create a dedicated IAM user in the company's account for the audit firm. Attach a policy allowing read-only access to the S3 bucket, generate long-term access keys, and share these credentials with the audit firm.
  2. B
    Generate a pre-signed S3 URL using the company's AWS account root user credentials, and provide the URL to the audit firm to download the logs directly.
  3. Create an IAM role in the company's account with a trust policy that allows the audit firm's AWS account to assume the role. Attach an IAM policy to the role that allows read-only access to the specific S3 bucket. Provide the IAM role ARN to the audit firm.Answer
  4. D
    Store the S3 access credentials as a plaintext parameter in AWS Systems Manager Parameter Store, and configure the S3 bucket policy to allow public access filtered by the audit firm's IP address range.

Answer

Create an IAM role in the company's account with a trust policy that allows the audit firm's AWS account to assume the role, attach a read-only policy to the S3 bucket, and provide the role ARN.
The correct solution uses an IAM role with a trust policy allowing cross-account access. By using IAM roles, the audit firm can assume the role to obtain temporary security credentials, avoiding the need to share long-term credentials. Applying a read-only policy to the specific S3 bucket ensures the principle of least privilege is maintained.

Step-by-Step Solution

1
Determine the credential requirement for third-party cross-account access.
Identify that temporary credentials via IAM roles are preferred over long-term IAM user credentials to meet security best practices.
IAM roles allow users or services from another AWS account to obtain temporary security credentials via the AWS Security Token Service (STS).
2
Configure the IAM role trust policy and permission policy.
Define a trust policy pointing to the third party's AWS account and a permission policy granting read-only access to the target S3 bucket.
This establishes trust between accounts while enforcing the principle of least privilege on the destination resource.
3
Provide the role ARN to the third party.
The third-party audit firm can now configure their applications or CLI to assume the role.
This allows the external entity to retrieve temporary credentials and perform the audit tasks without storing long-term credentials.

Key Concept

Cross-Account IAM Roles and Temporary Credentials
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic