Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A company is establishing its security baseline on AWS. The company needs to grant daily administrative access to its IT team and federate access for hundreds of workforce users managed in an external identity provider. Additionally, they must secure the AWS account owner identity. Which TWO actions should the solutions architect recommend to meet these requirements securely?

  1. Configure AWS IAM Identity Center to federate the external identity provider and manage user permissions using IAM roles.Answer
  2. Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to actions that specifically require root credentials.Answer
  3. C
    Create individual IAM users with long-term access keys for each workforce user and configure local password policies.
  4. D
    Use the AWS account root user credentials to perform daily administrative tasks to simplify operational overhead.
  5. E
    Store sensitive API secrets as plaintext parameters in Systems Manager Parameter Store to allow administrative scripts to retrieve them without encryption overhead.

Answer

Configure AWS IAM Identity Center to federate the external identity provider and manage user permissions using IAM roles, and enable multi-factor authentication (MFA) on the AWS account root user while restricting its use to actions that specifically require root credentials.
Securing the AWS infrastructure requires following best practices for user access and account security. The recommended approach is to federate workforce users from the external identity provider using AWS IAM Identity Center, allowing them to assume IAM roles for daily operations. Additionally, the AWS account root user should be secured with multi-factor authentication (MFA) and reserved strictly for tasks that require root credentials, rather than daily operations.

Step-by-Step Solution

1
Evaluate identity management requirements for workforce users.
Identify that using federated access via AWS IAM Identity Center avoids managing individual IAM users with long-term keys.
Aligns with AWS security best practices for centralized identity management.
2
Evaluate security requirements for the account owner identity.
Identify that the AWS account root user should be protected with multi-factor authentication (MFA) and not used for daily administrative work.
Ensures root credentials are secure and adheres to the principle of least privilege.

Key Concept

AWS Identity and Access Management (IAM) security best practices, including federating workforce identities with AWS IAM Identity Center and securing the root user account.
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic