Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

A financial technology startup is preparing for a compliance audit. An external auditing firm requires temporary, read-only access to the startup's AWS resources. The external auditors do not possess AWS accounts, and the startup's security policy strictly prohibits creating permanent IAM users for third-party entities. Which of the following is the most secure, AWS-recommended method to grant the auditors access?

  1. Configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role.Cevap
  2. B
    Create a shared IAM user named 'Auditor-Group' with read-only policies, generate a set of permanent access keys, and share them securely with the auditing firm.
  3. C
    Create an IAM role with the required permissions and grant the startup's AWS Account Root User the ability to assume this role, then share the root user credentials with the auditors.
  4. D
    Submit a ticket to AWS Support asking AWS to manage, monitor, and configure the temporary auditor access to the startup's resources on their behalf.

Cevap

Configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role.
The correct option is to configure AWS IAM Identity Center to federate the external auditors using their existing corporate identity provider, granting them temporary security credentials through an assigned IAM role. This aligns with AWS security best practices by utilizing temporary security credentials, avoiding the creation of long-term IAM credentials (such as access keys), and maintaining the principle of least privilege without creating permanent IAM users in the startup's AWS account.

Adım Adım Çözüm

1
Identify the access requirements and constraints.
The auditors need temporary, read-only access without creating permanent IAM users or using pre-existing AWS accounts.
This establishes the boundaries for acceptable security configurations.
2
Evaluate the mechanism for external user access.
Federating identity using AWS IAM Identity Center maps the external auditor identities to a temporary role.
Federation avoids static credential management and delegates authentication to the trusted third-party provider.
3
Select the option that matches AWS identity best practices.
Using IAM Identity Center to provision temporary access via role assumption is selected.
This follows the principle of least privilege and avoids credentials exposure.

Anahtar Kavram

Identity Federation and Temporary Credentials
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru