Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

An enterprise manages its applications using separate AWS accounts for development and production. A developer in the development account needs to temporarily read logs from an Amazon S3 bucket located in the production account. Which of the following approaches represents the AWS-recommended security best practice to configure this cross-account access?

  1. Create an IAM role in the production account that grants read-only access to the S3 bucket, and configure a trust policy allowing the developer's identity in the development account to assume it.Cevap
  2. B
    Create an identical IAM user in the production account with permanent access keys, and configure the developer's local tools to use these credentials.
  3. C
    Enable root user access in the production account and share the credentials with the developer to perform the analysis.
  4. D
    Submit a request to AWS Support to move the S3 bucket into the development account, as AWS is responsible for configuring customer data boundaries.

Cevap

Create an IAM role in the production account that grants read-only access to the S3 bucket, and configure a trust policy allowing the developer's identity in the development account to assume it.
The correct option outlines the AWS-recommended way to grant cross-account access. By creating an IAM role in the production account with a trust policy that trusts the development account, the developer can assume the role temporarily. This avoids using permanent credentials and adheres to the principle of least privilege.

Adım Adım Çözüm

1
Define the access policy
An IAM policy is created in the production account specifying read-only permissions for the target Amazon S3 bucket.
To ensure the principle of least privilege is applied, limiting access to only the required resources and actions.
2
Create the cross-account IAM role
An IAM role is created in the production account with the read-only policy attached and a trust policy that references the development AWS account ID.
This establishes trust between the two accounts, enabling identities in the development account to assume the role.
3
Assume the role and access the resource
The developer in the development account uses the AWS Security Token Service (STS) to assume the role, obtaining temporary security credentials to access the production S3 bucket.
To access the logs securely without requiring long-term credentials or creating additional IAM users in the production account.

Anahtar Kavram

Cross-account access using IAM roles allows users from one AWS account to access resources in another account securely via temporary security credentials.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru