Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A company has multiple AWS accounts managed under AWS Organizations. The security audit team in the central audit account needs read-only access to Amazon S3 buckets containing CloudTrail logs in all member accounts. A solutions architect must configure this access securely following the principle of least privilege. Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create an IAM role in each member account with a trust policy that trusts the central audit account, and attach a policy allowing read-only access to the S3 buckets.Answer
  2. Grant permissions to the security audit team members in the central audit account to assume the IAM roles in the member accounts.Answer
  3. C
    Create individual IAM users in each member account for every security auditor and generate permanent access keys for their access.
  4. D
    Distribute the AWS account root user credentials of each member account to the security audit team to allow unrestricted read access.
  5. E
    Store the security audit team's access keys in Systems Manager Parameter Store as plaintext String parameters for programmatic access.

Answer

The solutions architect should create an IAM role in each member account that trusts the central audit account and allows read-only access to the S3 buckets. Additionally, the security audit team members in the central audit account must be granted permissions to assume those roles.
Establishing cross-account access securely involves creating an IAM role in the target (member) accounts with a trust policy that trusts the trusted (audit) account, along with a permissions policy granting read-only S3 access. Additionally, users in the trusted account must be granted permissions to assume that cross-account role.

Step-by-Step Solution

1
Configure the receiving accounts (member accounts) to trust the sending account.
An IAM role is created in each member account with a trust policy that points to the central audit account ID, allowing users from that account to assume the role.
This establishes cross-account trust securely without creating IAM users or long-term credentials in the target accounts.
2
Configure the permissions within the receiving accounts' roles.
An IAM permission policy is attached to the role, granting read-only access specifically to the S3 buckets containing CloudTrail logs.
This limits the scope of the assumed role to only the required resources, enforcing the principle of least privilege.
3
Grant assume role permissions to the audit team in the central account.
The IAM users, groups, or roles representing the audit team in the central audit account are given a policy allowing the sts:AssumeRole action on the ARN of the roles in the member accounts.
This enables the audit team to dynamically assume the target roles in the member accounts to perform their audit tasks.

Key Concept

Cross-account access using IAM roles allows users from one AWS account to access resources in another AWS account securely without creating duplicate IAM users or using long-term credentials.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic