Examkin

Question

Difficulty: Very hardIdentity and Access Management (IAM)

A company needs to grant a third-party auditing firm temporary access to run configuration compliance checks on resources across all accounts in its AWS Organization. The auditing firm will access the organization's accounts from their own AWS account (123456789012123456789012) using a commercial automated tool. The company's security policy requires that:

- The auditing tool must only be allowed to read resource configuration metadata, with no access to read actual data stored in Amazon S3 buckets or databases.
- The configuration must mitigate the risk of the 'confused deputy' security vulnerability.
- The access granted to the auditing firm must automatically expire in 3030 days without requiring manual intervention.

Which solution meets these requirements securely and with the least administrative overhead?

  1. A
    Share the AWS account root user credentials of the company's AWS Organizations management account with the auditing firm to allow direct access. Set a calendar reminder to manually change the root user password and rotate the multi-factor authentication (MFA) token after 3030 days to revoke their access.
  2. B
    Create a dedicated IAM user in the company's AWS Organizations management account. Attach the AWS-managed ReadOnlyAccess policy to this user, generate long-term access keys, and provide them to the auditing firm. Configure an Amazon S3 lifecycle policy to delete the credentials document after 3030 days.
  3. Create an IAM role in the company's AWS Organizations management account that trusts the auditing firm's AWS account (123456789012123456789012). In the trust policy, specify a condition for the unique external ID provided by the auditing firm and a DateLessThan condition restricting the current time to 3030 days. Attach the AWS-managed SecurityAudit policy to this role.Answer
  4. D
    Create an IAM user with access keys configured to assume an administrative role. Store the IAM user's Access Key ID and Secret Access Key as a plaintext String parameter in AWS Systems Manager Parameter Store. Configure an AWS Lambda function to run daily to delete the parameter and the IAM user after 3030 days.

Answer

Create an IAM role in the company's AWS Organizations management account that trusts the auditing firm's AWS account. Use a trust policy containing conditions for the unique external ID and a DateLessThan current time condition set to 3030 days, while attaching the SecurityAudit managed policy.
The correct solution involves creating a cross-account IAM role that trusts the auditing firm's AWS account. To address the confused deputy problem, a condition for the external ID is added to the trust policy. The requirement for automatic expiration after 3030 days is met by using the DateLessThan condition block with the aws:CurrentTime key in the trust policy. The SecurityAudit AWS-managed policy provides read-only access to resource metadata and configurations (such as AWS Config or CloudTrail) without granting access to actual customer data inside Amazon S3 or databases.

Step-by-Step Solution

1
Determine the correct access mechanism
Utilize role-based cross-account access rather than creating IAM users or sharing root credentials to adhere to AWS security best practices.
This establishes temporary security credentials and avoids managing long-term access keys.
2
Address the confused deputy risk
Include the unique external ID provided by the third-party auditor in the trust policy condition block (sts:ExternalId).
This ensures the auditing firm's tool only assumes the role when acting specifically on behalf of the company.
3
Enforce automatic expiration
Implement a temporal constraint in the trust policy using the DateLessThan condition block compared against aws:CurrentTime set to 3030 days in the future.
This prevents STS from issuing credentials once the date threshold is exceeded, meeting the automatic expiration requirement.
4
Apply least privilege permissions
Attach the AWS-managed SecurityAudit policy to the role.
This policy allows read-only access to configurations and metadata without exposing raw customer data in databases or Amazon S3.

Key Concept

Implementing secure cross-account access using IAM roles, mitigating the confused deputy vulnerability using external IDs, enforcing temporary access duration with temporal policy conditions, and applying least privilege with predefined security audit policies.
Estimated Time:3m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic