A company is configuring a newly created AWS account. A solutions architect must set up secure administrative access for a newly hired systems engineer who will perform daily operations, such as managing Amazon EC2 instances and configuring Amazon S3 buckets. The systems engineer should not have access to billing information.
Which actions should the solutions architect take to configure this access securely? (Select TWO.)
- Create an IAM user for the systems engineer and attach a policy that grants only the permissions required for daily operations.Answer
- Enable multi-factor authentication (MFA) on both the AWS account root user and the systems engineer's IAM user.Answer
- CProvide the systems engineer with the email address and password of the AWS account root user to perform daily operations.
- DManually create individual IAM users with long-term access keys for each engineer in the corporate directory instead of configuring single sign-on federation.
- EStore the systems engineer's AWS access keys as plaintext String parameters in Systems Manager Parameter Store to automate command-line tasks.
Answer
Create an IAM user with least-privilege permissions and enable multi-factor authentication (MFA) for both the root user and the systems engineer's IAM user.
Creating a dedicated IAM user with only the necessary permissions ensures that the systems engineer cannot access billing or perform unauthorized actions, adhering to the principle of least privilege. Enabling multi-factor authentication (MFA) on both the root user and the IAM user provides an essential layer of security to prevent unauthorized access.
Step-by-Step Solution
Key Concept
Principle of least privilege and securing credentials using IAM users and MFA.
Estimated Time:1m 0s