Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

An enterprise uses AWS IAM Identity Center to federate identity provider users into their AWS development account. The junior solutions architects in this account need the ability to create and manage IAM roles for Amazon EC2 instances. However, the senior security team requires that these junior architects must not be able to elevate their own permissions or assign administrative permissions to the EC2 instances they configure. Which TWO actions should the solutions architect take to meet these requirements?

  1. Create a permissions boundary IAM policy that defines the maximum permissions that the junior architects can delegate to the EC2 roles.Answer
  2. Attach an IAM policy to the junior architects' federated role that permits role creation only when the request includes the permissions boundary condition referencing the boundary policy.Answer
  3. C
    Create individual IAM users with long-term access keys for each junior architect to bypass identity federation and assign them direct administrative access.
  4. D
    Provide the junior architects with temporary access to the AWS account root user credentials to perform administrative role creation tasks.
  5. E
    Store the role permissions as a plaintext String in an AWS Systems Manager Parameter Store parameter, and configure the EC2 instances to retrieve and apply the permissions at startup.

Answer

To secure delegated role creation, the solutions architect should create a permissions boundary policy to define the maximum delegated permissions and require the junior architects to apply this boundary policy whenever they create an IAM role.
Delegating the creation of IAM roles to non-administrator users without risk of privilege escalation is achieved using IAM Permissions Boundaries. First, a permissions boundary policy defines the upper limit of permissions. Second, the policy governing the creators (junior architects) is configured to require this permissions boundary when executing role creation commands. This prevents them from granting administrative rights or access they do not possess.

Step-by-Step Solution

1
Define the boundaries of delegation.
A permissions boundary policy is created in IAM that outlines the maximum set of permissions a junior architect can assign.
This establishes a hard limit on what the newly created roles can do, regardless of the policies attached to them.
2
Enforce boundary usage on role creation.
An IAM policy is attached to the junior architects' role containing a condition that permits iam:CreateRole and iam:PutRolePolicy/iam:AttachRolePolicy only if the iam:PermissionsBoundary matches the boundary policy ARN.
This prevents junior architects from creating unmanaged or administrative roles that could bypass security limits.

Key Concept

Delegated Administration with IAM Permissions Boundaries
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic