Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A financial services company is setting up a development AWS account. The company wants to allow the development team leads to create and manage IAM roles for their applications' Amazon EC2 instances. However, the security team must ensure that the team leads cannot create roles that grant access to sensitive S3 buckets, even though the team leads themselves have administrative permissions in the account. Which solution meets these security requirements with the least administrative overhead?

  1. A
    Create individual IAM users with long-term security credentials for the applications, and manually attach the required permissions to each user while explicitly denying access to the sensitive S3 buckets.
  2. B
    Store a list of approved S3 buckets in Systems Manager Parameter Store as a plaintext parameter, and configure an AWS Lambda function triggered by AWS CloudTrail to delete newly created roles that violate these rules.
  3. Configure an IAM permissions boundary that defines the maximum allowed permissions, excluding access to the sensitive S3 buckets. Attach an IAM policy to the team leads that allows role creation only if this permissions boundary is applied to the new role.Answer
  4. D
    Enable KMS customer managed key automatic annual rotation, and configure the team leads to encrypt all new IAM roles with the rotated KMS key to automatically revoke S3 permissions for historical data.

Answer

Configure an IAM permissions boundary that defines the maximum allowed permissions, excluding access to the sensitive S3 buckets. Attach an IAM policy to the team leads that allows role creation only if this permissions boundary is applied to the new role.
The correct solution is to use an IAM permissions boundary. A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity (user or role). When a permissions boundary is set on a role, the role can only perform actions that are allowed by both its identity-based policy and its permissions boundary. By requiring the team leads to specify this boundary when creating new roles (using the 'iam:PermissionsBoundary' condition key in their own IAM policy), the security team can safely delegate role creation without risking privilege escalation.

Step-by-Step Solution

1
Define the maximum allowable permissions for any application role by creating an IAM permissions boundary policy that denies access to the sensitive S3 buckets.
An IAM policy is created representing the boundary, which sets the maximum ceiling of permissions for roles created under it.
This establishes the hard security limit that delegated administrators cannot exceed.
2
Create an IAM policy for the team leads that allows the 'iam:CreateRole' and 'iam:PutRolePolicy' actions.
The team leads gain the permissions to create roles and attach policies locally within the development account.
This enables delegation of administrative tasks to the team leads.
3
Add a condition to the team leads' IAM policy that requires the 'iam:PermissionsBoundary' key to match the ARN of the permissions boundary policy created in step 1.
The team leads can only create roles if they specify the approved permissions boundary during creation.
This prevents privilege escalation by ensuring that any role they create is constrained by the security baseline.

Key Concept

IAM Permissions Boundary
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic