Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company needs to grant 500 external contractors access to specific AWS resources in a single AWS account. The contractors already have identities managed in an external OpenID Connect (OIDC) compliant identity provider. The company's security policy states that no long-term AWS credentials should be created for these contractors, and they must authenticate using their existing corporate credentials. Which solution meets these security requirements with the least administrative overhead?

  1. Establish a trust relationship between AWS and the external OIDC identity provider by creating an OIDC identity provider in IAM, map the provider to IAM roles with the necessary permissions, and configure the contractors to assume these roles.Answer
  2. B
    Create individual IAM users in the AWS account for each contractor, assign them to an IAM group with the required permissions, and require them to set up multi-factor authentication (MFA) for console login.
  3. C
    Enable console access for the AWS account root user, share the root credentials with the contractor team lead, and instruct the lead to create and manage the necessary resources on behalf of all contractors.
  4. D
    Retrieve the corporate credentials from the OIDC identity provider, store them as plaintext String parameters in AWS Systems Manager Parameter Store, and write a custom Lambda function to validate contractors during login.

Answer

Establish a trust relationship between AWS and the external OIDC identity provider by creating an OIDC identity provider in IAM, map the provider to IAM roles with the necessary permissions, and configure the contractors to assume these roles.
Establishing a trust relationship with the external OIDC provider and mapping groups to IAM roles allows contractors to assume roles and receive temporary credentials. This satisfies the requirement of using existing corporate credentials, avoids creating long-term AWS credentials, and minimizes administrative overhead.

Step-by-Step Solution

1
Configure the identity provider (IdP) in AWS IAM.
AWS IAM establishes a trust relationship with the external OIDC-compliant identity provider.
This enables external users to authenticate using their existing corporate credentials without storing their passwords in AWS.
2
Create IAM roles with appropriate trust policies and permissions.
Roles are created that trust the OIDC identity provider and have permission policies attached.
This allows the external users to assume these roles and obtain short-term security credentials for access.
3
Configure the mapping between the IdP groups and AWS IAM roles.
Contractors are mapped to specific roles based on their group membership in the external IdP.
This ensures the principle of least privilege is enforced dynamically based on user identity, with zero long-term credentials created.

Key Concept

Federating identity providers with AWS IAM using OIDC allows external users to securely access AWS resources using temporary security credentials, avoiding the administrative overhead and security risks of managing individual IAM users.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic