An organization wants to grant their third-party auditing team temporary access to audit their AWS cloud resources for compliance. At the same time, the organization needs to allow their database administrators to manage Amazon RDS resources without sharing credentials or using individual user policies. Which of the following configurations align with AWS Identity and Access Management (IAM) best practices? (Select TWO.)
- Assign the database administrators to an IAM group and attach an IAM policy to that group that grants permissions to manage Amazon RDS.Cevap
- Create an IAM role for the third-party auditors with a trust policy that allows the external audit account to assume the role.Cevap
- CShare the database administrator's individual IAM user access keys with the third-party auditing team to simplify access control.
- DProvide the third-party auditors with the AWS account root user credentials for the duration of the audit.
- ERequest AWS Support to configure the third-party auditors' password strength policies and local workstation security settings.
Cevap
Assigning database administrators to an IAM group with an attached IAM policy, and creating an IAM role for the third-party auditors to assume.
Assigning database administrators to an IAM group and attaching an IAM policy to the group is the recommended way to manage human user permissions efficiently. Creating an IAM role with a trust policy for the third-party auditors enables secure cross-account delegation with temporary credentials, avoiding the risk of credential leakage.
Adım Adım Çözüm
Anahtar Kavram
AWS IAM access control best practices including group-based permissions and cross-account delegation using roles.