Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is preparing for an internal security audit of its AWS environment. The security team discovers that several developers are sharing a single set of access keys to perform administrative tasks, and an automated application is using the AWS account root user credentials to generate daily billing reports. Which of the following remediation steps should the security team take to align with AWS Identity and Access Management (IAM) best practices? (Select TWO.)

  1. Create individual IAM users for each developer, place them in an IAM group with administrative policies, and require Multi-Factor Authentication (MFA).Cevap
  2. Create an IAM role with the least privilege permissions required to view billing reports, and assign it to the automated application instead of using root credentials.Cevap
  3. C
    Generate a new set of shared access keys and distribute them to the developers to ensure they have the latest credentials.
  4. D
    Enable Multi-Factor Authentication (MFA) on the root user account and configure the automated application to use the MFA token for billing report generation.
  5. E
    Delegate the administration tasks and billing report generation entirely to AWS Support, as AWS is responsible for managing customer IAM permissions.

Cevap

Create individual IAM users for each developer, place them in an IAM group with administrative policies, and require Multi-Factor Authentication (MFA). In addition, create an IAM role with the least privilege permissions required to view billing reports, and assign it to the automated application instead of using root credentials.
The correct remediation involves establishing individual identities for users (individual IAM users in a group with MFA enforced) and utilizing temporary credentials with minimum permissions for applications (an IAM role with least privilege permissions), thus avoiding shared access keys and the root user.

Adım Adım Çözüm

1
Analyze the developer credential sharing issue.
Identify that sharing access keys violates accountability and security boundaries. The correct fix is to create unique IAM users for each person, manage them collectively using an IAM group, and enforce MFA for administrative tasks.
This establishes individual accountability and aligns with identity best practices.
2
Analyze the application using root credentials.
Identify that using the root user for programmatic reports is a severe security risk. The correct fix is to secure the root user and assign a least-privilege IAM role to the application.
This ensures the application only uses temporary, limited credentials and locks down the root account.

Anahtar Kavram

AWS IAM Best Practices for Users, Groups, Roles, and the Root User
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru