Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A multi-department enterprise has hired an external consulting firm to perform a security audit of their AWS environment. The auditors require read-only access to various AWS resources for a limited duration of two weeks. Which of the following is the AWS-recommended best practice to grant this external firm access to the enterprise's AWS account?

  1. A
    Create a dedicated IAM user with long-term access keys and share the credentials with the external firm.
  2. B
    Configure the AWS account root user credentials to permit temporary read-only console access for the audit.
  3. Create an IAM role with a read-only policy and establish a trust relationship allowing the external firm's AWS account to assume it.Cevap
  4. D
    Modify the enterprise's network security groups to allow the external firm to bypass standard AWS IAM authorization checks.

Cevap

Create an IAM role with a read-only policy and establish a trust relationship allowing the external firm's AWS account to assume it.
The correct option outlines the practice of creating an IAM role. An IAM role allows the external firm to assume the role using their own AWS account credentials, obtaining temporary security credentials for the duration of the audit without requiring the enterprise to share long-term access keys.

Adım Adım Çözüm

1
Identify the requirement for secure, temporary, and cross-account access for an external auditing firm.
The solution must provide limited-duration access without sharing permanent credentials.
Sharing permanent access keys or root user credentials violates AWS security standards.
2
Evaluate AWS IAM mechanisms for cross-account delegation.
An IAM role with a trust policy is identified as the optimal tool for cross-account access.
IAM roles leverage security token services to issue temporary security credentials, ensuring security and compliance.

Anahtar Kavram

Cross-account access delegation using IAM roles
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru