Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A company wants to allow external development contractors to deploy application resources in a development AWS account. The contractors manage their users in an external identity provider (IdP) that supports SAML 2.0. The security team requires that the contractors only be able to create IAM roles for their applications that do not exceed a specific security baseline. The contractors must not be able to escalate their own permissions or create roles that grant access to unauthorized services. Which TWO options should a solutions architect combine to meet these requirements securely? (Select TWO.)

  1. Configure SAML 2.0 identity federation to map the contractors' external identity provider groups to an IAM role in the AWS account, allowing them to assume the role.Answer
  2. Create an IAM policy for the contractor role that grants permission to create roles only if the role is created with a specific IAM permissions boundary policy attached, using the iam:PermissionsBoundary condition key.Answer
  3. C
    Create individual IAM users in the AWS account for each contractor and generate long-term access keys for them to authenticate via the AWS CLI.
  4. D
    Share the AWS account root user credentials with the contractors securely through AWS Secrets Manager to perform role creation tasks.
  5. E
    Store the API access key and secret key of a highly privileged administrative user as a plaintext string in Systems Manager Parameter Store for the contractors' deployment tools to retrieve.

Answer

Configure SAML 2.0 identity federation to map the external IdP groups to an IAM role, and use an IAM permissions boundary policy enforced via the iam:PermissionsBoundary condition key on the contractor role's permissions.
The correct options implement a secure, best-practice architecture. By configuring SAML 2.0 federation, the company avoids creating long-term IAM credentials for external contractors. Enforcing a permissions boundary via the iam:PermissionsBoundary condition key prevents the contractors from creating roles that exceed the baseline policy or escalating their own permissions.

Step-by-Step Solution

1
Establish secure federated access for external contractors.
Contractors authenticate using their existing external Identity Provider (IdP) via SAML 2.0, assuming a temporary session role in AWS instead of using long-term IAM user credentials.
Aligns with the principle of least privilege and eliminates the risk associated with managing and rotating static credentials.
2
Define the security baseline using an IAM permissions boundary policy.
An IAM permissions boundary policy is created that lists the maximum allowed actions (e.g., S3 and DynamoDB access).
This policy does not grant permissions by itself, but defines the maximum privilege limit for any role to which it is applied.
3
Enforce the boundary policy on the contractors' role creation actions.
An IAM policy attached to the contractors' assumed role allows the iam:CreateRole action only when accompanied by the iam:PermissionsBoundary condition key referencing the baseline boundary policy ARN.
Prevents contractors from creating roles with elevated privileges, effectively blocking privilege escalation.

Key Concept

Delegating role creation securely using SAML 2.0 federation and IAM Permissions Boundaries to prevent privilege escalation.
Estimated Time:2m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic