Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A company needs to configure administrative access for a systems administrator to manage AWS resources daily. According to AWS security best practices, which approach should the company use to grant this access?

  1. A
    Use the AWS account root user credentials for daily administrative tasks to simplify management.
  2. B
    Create individual IAM users with long-term credentials for each user in the external corporate directory.
  3. Create an IAM user with the required administrative permissions and require Multi-Factor Authentication (MFA).Answer
  4. D
    Store the administrative credentials in Systems Manager Parameter Store as a plaintext parameter for script access.

Answer

Create an IAM user with the required administrative permissions and require Multi-Factor Authentication (MFA).
The correct approach is to create a dedicated IAM user with the necessary administrative permissions and enforce Multi-Factor Authentication (MFA). AWS strongly recommends not using the root user for daily tasks, utilizing IAM roles/users with least privilege, and protecting privileged accounts with MFA.

Step-by-Step Solution

1
Evaluate the requirement for daily administrative access to AWS resources.
Identify that standard administrative tasks should follow the principle of least privilege and use separate credentials rather than root credentials.
To secure the AWS environment and prevent accidental or malicious actions that could compromise the entire account.
2
Select the appropriate IAM entity for the administrator.
Choose to create a dedicated IAM user (or use IAM Identity Center for federated access) and assign only the necessary permissions.
This aligns with the principle of least privilege and isolates the administrator's actions.
3
Apply additional security controls.
Enforce Multi-Factor Authentication (MFA) on the administrative user account.
MFA adds an essential layer of security to prevent unauthorized access even if the primary credentials are compromised.

Key Concept

AWS Identity and Access Management (IAM) Best Practices
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic