Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

An enterprise has migrated its identity management to an external SAML-based identity provider (IdP). The security team wants to implement a dynamic access control mechanism for developers who access AWS resources through federated roles. Developers should only be allowed to manage (start, stop, and terminate) Amazon EC2 instances that are tagged with a `Project` tag value matching their department's project assignment in the IdP. The solution must scale automatically without requiring IAM policy updates when new projects are created.

Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center to map the project attribute from the identity provider as a principal tag in the AWS federated session.Cevap
  2. Attach an IAM policy to the developers' permission set that allows EC2 actions only when the `aws:ResourceTag/Project` condition key matches the `aws:PrincipalTag/Project` key.Cevap
  3. C
    Create individual IAM users for each developer, organize them into IAM groups named after each project, and attach inline policies to each group restricting access to specific EC2 instance IDs.
  4. D
    Store project tag mappings and developer usernames as plaintext in Systems Manager Parameter Store, and configure a cron job to update IAM group memberships accordingly.
  5. E
    Use the AWS account root user credentials to run a scheduled Lambda function that periodically checks if EC2 instances have the correct project tags and deletes non-compliant resources.

Cevap

Configure AWS IAM Identity Center to map the project attribute from the identity provider as a principal tag, and attach an IAM policy that allows EC2 actions only when the `aws:ResourceTag/Project` key matches the `aws:PrincipalTag/Project` key.
Mapping the project attribute to a principal tag via IAM Identity Center enables Attribute-Based Access Control (ABAC). When combined with an IAM policy that requires the instance's `Project` tag to match the user's principal tag, access is granted dynamically. This eliminates the need to update policies for new projects.

Adım Adım Çözüm

1
Enable attribute mapping in AWS IAM Identity Center.
User attributes from the SAML IdP are mapped to AWS session tags (principal tags), making them available in the AWS authorization context.
This establishes the identity attribute (project assignment) on the federated user session dynamically.
2
Create an Attribute-Based Access Control (ABAC) IAM policy.
An IAM policy is created using the condition key `aws:ResourceTag/Project` compared with `${aws:PrincipalTag/Project}`.
This enforces that a user can only perform actions on resources that share the same project value as their identity.
3
Attach the ABAC policy to the permission set assigned to the developers.
Developers receive dynamic permissions based on their IdP attributes when federating into the AWS console or CLI.
This ensures the security policy is applied to all developer federated sessions without manually updating policies for new projects.

Anahtar Kavram

Attribute-Based Access Control (ABAC) and Identity Federation with IAM Identity Center
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru