Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company needs to grant temporary access to an Amazon S3 bucket in its AWS production account to external, third-party contractors. The contractors authenticate through an external OpenID Connect (OIDC) compliant identity provider and do not have their own AWS accounts. The company's security policy strictly prohibits the use of long-term credentials for external access. Which combination of actions should a solutions architect recommend to configure this access securely? (Select TWO.)

  1. Create an IAM identity provider for the OIDC-compliant identity provider in the AWS account.Answer
  2. Create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action, and attach an IAM policy that allows read and write permissions to the target S3 bucket.Answer
  3. C
    Create individual IAM users in the production account for each contractor, configure multi-factor authentication (MFA), and distribute long-term access keys to them.
  4. D
    Enable access keys for the AWS account root user, and configure a trust policy on the root user to delegate access to the external contractors.
  5. E
    Store a set of long-term IAM access keys as plaintext parameters in Systems Manager Parameter Store, and grant the contractors access to read these parameters.

Answer

Establish trust with the external OpenID Connect (OIDC) identity provider by creating an IAM identity provider, and configure an IAM role with a trust policy that permits the sts:AssumeRoleWithWebIdentity action combined with an S3 access policy.
The correct solution involves configuring web identity federation. By creating an IAM identity provider for the OIDC-compliant IdP, AWS can validate external tokens. Creating an IAM role that allows the 'sts:AssumeRoleWithWebIdentity' action in its trust policy enables the external contractors to dynamically exchange their OIDC token for temporary AWS security credentials, conforming to the least privilege principle and the requirement to avoid long-term credentials.

Step-by-Step Solution

1
Register the external identity provider (IdP) in IAM.
Trust is established between AWS and the OIDC-compliant provider.
This allows AWS to recognize and validate OIDC authentication tokens presented by the contractors.
2
Create an IAM role with a trust policy that specifies the OIDC identity provider as the principal.
The role can be assumed by external users via the web identity token exchange.
The trust policy must permit the action 'sts:AssumeRoleWithWebIdentity' to allow the OIDC provider's users to trade identity tokens for temporary AWS security credentials.
3
Attach a policy to the IAM role that grants permissions to the specific S3 bucket.
Temporary credentials obtained from assuming the role only possess read and write access to the targeted S3 bucket.
This enforces the principle of least privilege by scoping the temporary credentials to only the necessary resources.

Key Concept

Web Identity Federation (OIDC) and IAM Roles
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic