Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is integrating its AWS environment with a third-party SaaS monitoring tool. The SaaS vendor requires read-only access to the company's AWS resources to collect performance metrics. The security team mandates that the integration must prevent the 'confused deputy' problem and avoid the use of long-term credentials. Which combination of actions should a solutions architect recommend to configure this access? (Select TWO.)

  1. Create an IAM role in the company's AWS account with a trust policy that specifies the SaaS vendor's AWS account ID as the principal and includes a condition requiring a unique external ID.Answer
  2. Attach an IAM permissions policy to the role that grants read-only access to the required AWS services.Answer
  3. C
    Create an IAM user in the company's AWS account, assign the ReadOnlyAccess managed policy, and share the access keys with the SaaS vendor.
  4. D
    Share the AWS account root user credentials with the SaaS vendor to enable read-only access across the entire AWS Organization.
  5. E
    Configure the SaaS vendor's application to store its authentication parameters as plaintext String parameters in AWS Systems Manager Parameter Store.

Answer

Create an IAM role in the company's AWS account with a trust policy specifying the SaaS vendor's AWS account ID and a unique external ID condition, and attach a read-only permissions policy to this role.
The correct configuration is to create an IAM role that delegates access to the SaaS vendor's AWS account while validating a unique external ID in the trust policy's condition block. This allows the vendor's application to assume the role securely without requiring long-term AWS credentials. In addition, attaching a read-only permissions policy to this role ensures that the vendor has only the permissions required to gather metrics, adhering to the principle of least privilege.

Step-by-Step Solution

1
Define the trust relationship for the cross-account IAM role.
An IAM role is created with a trust policy that designates the SaaS vendor's AWS account ID as the trusted entity and specifies a unique external ID in the condition block.
This establishes cross-account delegation and mitigates the confused deputy problem by verifying the unique external ID during the role assumption process.
2
Define and attach the permissions policy to the IAM role.
A read-only permissions policy is attached to the IAM role, restricting the actions the SaaS vendor can perform to only what is required.
This enforces the principle of least privilege, preventing the SaaS vendor from making unauthorized modifications or accessing unrelated resources.

Key Concept

Cross-account IAM roles with external IDs are used to securely delegate access to third-party SaaS vendors while mitigating the confused deputy vulnerability.
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic