Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company's security team wants to delegate the creation and management of IAM roles for microservices to development team leads in several member accounts within an AWS Organization. However, the security team must ensure that team leads cannot create roles or modify policies that allow access to a centralized audit Amazon S3 bucket. Which solution should the security team implement to meet these requirements?

  1. Configure an IAM permissions boundary that denies access to the centralized audit S3 bucket, and require the team leads to apply this boundary when creating any new IAM roles.Answer
  2. B
    Share the AWS account root user credentials of each member account with the team leads so they can perform role administration tasks securely without needing IAM policies.
  3. C
    Create individual IAM users with long-term credentials for each team lead, and store these credentials as plaintext String parameters in Systems Manager Parameter Store for the microservices to use.
  4. D
    Set up SAML-based identity federation for team lead access, but create individual IAM users with long-term access keys in each member account for their daily role management tasks.

Answer

Configure an IAM permissions boundary that denies access to the centralized audit S3 bucket, and require the team leads to apply this boundary when creating any new IAM roles.
The correct solution uses an IAM permissions boundary. A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. When you delegate IAM role creation to a user or role, you can enforce that they can only create roles with a specific permissions boundary attached. This prevents the delegated administrator from creating roles that have more permissions than allowed, protecting resources like the central audit S3 bucket.

Step-by-Step Solution

1
Analyze the requirement to delegate IAM role creation to team leads while preventing them from granting access to a specific S3 bucket.
Identify that the team leads need permissions to create IAM roles, but must be restricted from escalating privileges beyond a certain limit.
This establishes the need for a mechanism that sets the maximum permissions an IAM entity can delegate.
2
Evaluate AWS IAM features designed for delegating administration with permission limits.
Identify IAM permissions boundaries as the native feature that controls the maximum permissions an IAM policy can grant to a principal or role.
Permissions boundaries ensure that even if a team lead creates a role with AdministratorAccess, that role's effective permissions are limited by the boundary.
3
Formulate a policy that denies access to the centralized audit S3 bucket and use it as the permissions boundary.
A boundary policy is created and enforced via an IAM policy on the team leads, requiring them to attach the boundary to any roles they create.
This meets the security requirement with the least operational overhead and aligns with AWS best practices.

Key Concept

IAM Permissions Boundaries
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic