Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A cloud architect at a media agency needs to manage AWS permissions for a team of 15 video editors and 5 system administrators. The video editors require read-only access to Amazon S3 buckets, while the administrators need full access to Amazon EC2 and Amazon RDS. Which of the following represents the most efficient way to manage and apply these permissions using AWS Identity and Access Management (IAM)?

  1. A
    Configure all 20 team members to use the AWS account root user credentials, using Service Control Policies (SCPs) to limit their access based on their job function.
  2. B
    Create a single IAM role containing both sets of permissions and configure the individual users to assume this role simultaneously upon logging in.
  3. Create two separate IAM groups, attach the appropriate managed policies to each group, and add the individual user accounts to their respective groups.Cevap
  4. D
    Upload a list of user roles to the AWS Artifact portal and allow AWS to automatically assign and manage the permissions under the Shared Responsibility Model.

Cevap

Create two separate IAM groups, attach the appropriate managed policies to each group, and add the individual user accounts to their respective groups.
Creating separate IAM groups for the video editors and the system administrators is the most efficient and recommended practice. By attaching the relevant policies to the groups and adding the individual users to them, permissions can be centrally managed. When users are added or removed from the team, the administrator only needs to add or remove them from the group, preventing configuration drift.

Adım Adım Çözüm

1
Analyze the operational requirements of the two user categories: 15 video editors requiring S3 read-only access, and 5 system administrators requiring EC2 and RDS full access.
Identified two distinct sets of permission requirements for the two user cohorts.
Understanding permission boundaries helps determine the best IAM structure.
2
Evaluate AWS IAM best practices for managing permissions for multiple users with identical job functions.
Recognized that IAM groups are designed to cluster users and attach policies collectively rather than individually.
Using IAM groups reduces administrative overhead and minimizes errors in permission management.
3
Map the correct policies to two groups and assign the respective individual users to these groups.
Created one group for video editors (with S3 read-only policy) and one group for system administrators (with EC2 and RDS full access policies).
This establishes a scalable, secure, and easily auditable access control structure.

Anahtar Kavram

AWS IAM Groups and Permission Management
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru