Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company wants to grant a third-party security audit application access to read log files in an Amazon S3 bucket within the company's AWS account. The third-party application runs in the auditor's AWS account. The company's security policy dictates that no long-term credentials can be shared, and the design must prevent the 'confused deputy' problem. Which configuration should a solutions architect implement to meet these security requirements?

  1. Create an IAM role in the company's account with a trust policy that allows the auditor's AWS account to assume the role, conditioning the trust policy on a unique External ID provided by the auditor. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket.Answer
  2. B
    Create a dedicated IAM user in the company's account, attach a policy granting read-only access to the S3 bucket, and store the credentials in AWS Systems Manager Parameter Store as a String parameter.
  3. C
    Create an IAM role in the company's account with a trust policy allowing the auditor's AWS account to assume the role, but perform daily log exports using the AWS account root user to transfer the log files to the auditor's S3 bucket.
  4. D
    Create a dedicated IAM user in the company's account for the auditor, attach a policy granting read-only access to the S3 bucket, and set up federated single sign-on (SSO) access from the auditor's directory directly to this IAM user.

Answer

Create an IAM role in the company's account with a trust policy that allows the auditor's AWS account to assume the role, conditioning the trust policy on a unique External ID provided by the auditor. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket.
The correct configuration involves creating an IAM role in the company's account with a trust policy that allows the auditor's account to assume the role. By requiring an External ID in the condition block of the trust policy, the configuration prevents the confused deputy problem, which is a security risk where an entity that does not have permission to access a resource can coerce a more privileged entity (the third-party audit tool) to access it. An IAM policy attached to the role restricts permissions to read-only access on the S3 log bucket, following the principle of least privilege.

Step-by-Step Solution

1
Establish secure access for the third-party AWS account by using IAM roles instead of sharing long-term credentials.
An IAM role is defined in the resource owner's account that can be assumed by the trusted third-party account using temporary security credentials.
This satisfies the security requirement to avoid sharing long-term access keys or secret keys.
2
Address the confused deputy problem by adding a condition to the role's trust policy.
The role's trust policy is configured with an External ID condition that requires the third party to present a specific, unique string when assuming the role.
The External ID ensures that the role cannot be assumed by the third party on behalf of other customers, preventing unauthorized cross-tenant access.
3
Apply the principle of least privilege by attaching a permissions policy to the IAM role.
A permissions policy is attached that grants read-only permissions limited to the specific S3 log bucket.
This ensures the auditor has only the minimum necessary permissions required to perform their security audit.

Key Concept

AWS IAM Roles and External IDs for Secure Cross-Account Third-Party Access
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic