Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

A software development firm manages a multi-account AWS environment. A developer in the development account needs temporary administrative access to perform emergency troubleshooting on resources in the production account. Which of the following options represents the most secure, AWS-recommended method to achieve this?

  1. A
    Create a dedicated IAM user in the production account with administrative permissions, and configure the developer's development tools with these static credentials.
  2. Create an IAM role in the production account with a trust policy that allows the development account to assume it, and grant the developer permission to assume this role.Cevap
  3. C
    Enable multi-factor authentication (MFA) on the production account's root user, and share the root user credentials with the developer for temporary troubleshooting access.
  4. D
    Do not configure permissions, as AWS automatically manages cross-account resource access under the infrastructure security portion of the AWS Shared Responsibility Model.

Cevap

Create an IAM role in the production account with a trust policy that allows the development account to assume it, and grant the developer permission to assume this role.
The correct method is to create an IAM role in the production account that trusts the development account, and then allow the developer to assume this role. This approach follows the security best practice of using temporary credentials (via AWS STS) for cross-account delegation, eliminating the need to create static credentials or duplicate users across multiple accounts.

Adım Adım Çözüm

1
Evaluate the need for cross-account access and identify the appropriate IAM entity.
Determine that IAM roles are designed to delegate access to resources across different AWS accounts using temporary credentials.
IAM roles allow users in one account to assume permissions in another account securely without creating duplicate IAM users or sharing static keys.
2
Configure the trust policy of the target IAM role in the production account.
Define a trust policy that specifies the development account ID as a trusted principal.
This establishes a cryptographic trust relationship, allowing users in the trusted development account to assume the role.
3
Grant the developer permission to assume the cross-account role.
Attach an IAM policy to the developer's IAM user or group in the development account that allows the sts:AssumeRole action on the production role's ARN.
The developer must have explicit permission to request the temporary credentials from AWS STS.

Anahtar Kavram

Cross-account access delegation using IAM roles and temporary security credentials.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru