Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company needs to grant a third-party audit team temporary access to run query analysis on Amazon Athena using data stored in an Amazon S3 bucket. The audit team manages their users through their own external identity provider (IdP). Which of the following is the most secure method to grant the audit team access according to AWS security best practices?

  1. Configure identity federation using the audit team's external identity provider to allow their users to assume an IAM role that grants least-privilege permissions to Amazon Athena and the S3 bucket.Answer
  2. B
    Create individual IAM users for each member of the audit team in the company's AWS account, attach the required Athena and S3 access policies, and generate long-term access keys.
  3. C
    Provide the lead auditor with the AWS account root user credentials and set up a reminder to change the root password and rotate access keys once the audit is finished.
  4. D
    Create a shared IAM user, generate the access key and secret key, and store them as a plaintext String parameter in AWS Systems Manager Parameter Store for the auditors to retrieve.

Answer

Configure identity federation using the audit team's external identity provider to allow their users to assume an IAM role that grants least-privilege permissions to Amazon Athena and the S3 bucket.
The correct answer is to configure identity federation using the external identity provider (IdP) to allow the audit team to assume an IAM role. This solution avoids creating local IAM users with long-term credentials and aligns with the AWS well-architected framework security pillar, providing short-lived, least-privilege credentials.

Step-by-Step Solution

1
Identify the requirement to grant temporary access to external users managed by an external identity provider.
Determine that AWS Identity Federation should be utilized instead of creating local IAM users.
Using federation avoids the creation and management of long-term credentials for external entities, satisfying security best practices.
2
Define the mechanism of access delegation using IAM roles.
Establish an IAM role with a trust policy that trusts the external IdP, granting least-privilege permissions to Amazon Athena and the Amazon S3 bucket.
IAM roles provide temporary, short-lived security credentials which automatically expire, reducing the blast radius of credential leaks.
3
Eliminate unsafe credential handling and administrative root usage.
Reject options proposing the sharing of root credentials or storing active access keys in plaintext parameter store.
Root usage must be avoided for standard tasks, and credentials must always be encrypted at rest and in transit.

Key Concept

AWS Identity Federation and IAM Roles
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic