Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is hiring an external consulting firm to perform a compliance audit of data stored in an Amazon S3 bucket. The consulting firm has its own AWS account. The solutions architect must grant the consultants read-only access to the S3 bucket for the duration of the audit. The security team specifies that no long-term IAM credentials or new IAM users can be created, and the consultants must access the resources securely using temporary credentials. Which solution should the solutions architect implement to meet these requirements?

  1. A
    Generate access keys for the company's AWS account root user, and share them securely with the lead auditor of the consulting firm to perform the necessary audit tasks.
  2. Create an IAM role in the company's AWS account with a trust policy that allows the consulting firm's AWS account to assume the role. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket. Instruct the consultants to assume this role using AWS Security Token Service (AWS STS).Answer
  3. C
    Create individual IAM users in the company's AWS account for each consultant from the firm. Attach a read-only S3 permission policy to each user and generate access keys for them to use during the audit.
  4. D
    Store the credentials of an administrative IAM user in AWS Systems Manager Parameter Store as a plaintext String parameter, and configure a public parameter policy allowing the consultants to retrieve it.

Answer

Create an IAM role in the company's AWS account with a trust policy that allows the consulting firm's AWS account to assume the role, attaching a read-only S3 policy, and having the consultants assume the role using AWS STS.
The correct answer is correct because defining an IAM role with a trust policy that trusts the external consulting firm's AWS account allows the consultants to assume the role via AWS STS. This gives them temporary security credentials to access the target Amazon S3 bucket, meeting the security criteria of avoiding long-term access keys or the creation of local IAM users.

Step-by-Step Solution

1
Analyze the access requirements, identifying that cross-account access is needed between two distinct AWS accounts (the company's account and the consulting firm's account).
Identified the need for secure delegation of access across accounts.
Establishing cross-account boundaries helps define where trust policies and permission policies must be applied.
2
Configure an IAM role with a trust policy that specifies the principal as the consulting firm's AWS account ID, allowing users in that account to call the AssumeRole API.
Created a trusted relationship between the two accounts without creating local IAM users.
Trust policies govern which external entities are allowed to assume the role and obtain temporary credentials.
3
Attach a permissions policy to the IAM role that limits access to read-only actions (such as s3:GetObject and s3:ListBucket) on the target S3 bucket.
Enforced the principle of least privilege for the external auditors.
Permissions policies define what actions the trusted entity can perform once they assume the role.
4
Instruct the external consultants to use AWS Security Token Service (AWS STS) to assume the role, which provides them with short-lived, temporary security credentials.
Provided access to the resources without generating long-term IAM access keys.
AWS STS facilitates the secure exchange of cross-account trust into temporary session credentials.

Key Concept

Cross-Account IAM Roles and AWS STS Federation
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic