Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is onboarding an external contractor team to manage application servers running on Amazon EC2. The contractors authenticate using an external SAML 2.0 identity provider (IdP). The solutions architect must grant the contractors permission to start and stop EC2 instances, ensuring they can only manage instances assigned to their specific project team. The solution must avoid the use of long-term credentials and minimize administrative overhead. Which solution should the solutions architect recommend to meet these requirements?

  1. A
    Create individual IAM users in the AWS account for each contractor, assign them to an IAM group, and generate long-term access keys to allow them to manage the EC2 instances via the AWS CLI.
  2. Configure SAML 2.0 federation to allow contractors to assume an IAM role. Attach an IAM policy to the role that allows ec2:StartInstances and ec2:StopInstances, using a policy condition that matches the principal's project tag with the EC2 instance's project tag.Cevap
  3. C
    Configure SAML 2.0 federation to allow contractors to assume an IAM role. Store the long-term AWS access key and secret key for an administrative IAM user in Systems Manager Parameter Store as a standard String parameter, allowing the contractors' scripts to retrieve them.
  4. D
    Share the AWS account root user credentials with the contractor team lead to perform EC2 operations, and enable Multi-Factor Authentication (MFA) on the root account to secure access.

Cevap

The solution that configures SAML 2.0 federation to allow contractors to assume an IAM role, and uses a policy condition to match the principal's project tag with the EC2 instance's project tag.
Configuring SAML 2.0 federation allows users to authenticate via their corporate identity provider and assume an IAM role, which provides temporary security credentials. Employing Attribute-Based Access Control (ABAC) by matching principal tags with resource tags dynamically enforces fine-grained access control. This solution automatically scales as new project teams are added without needing to modify existing IAM policies, thus minimizing administrative overhead.

Adım Adım Çözüm

1
Establish federation with the corporate identity provider.
Contractors can authenticate and assume an IAM role to receive temporary security credentials, avoiding long-term access keys.
Security best practices dictate using temporary credentials via federation for external users.
2
Implement Attribute-Based Access Control (ABAC) using resource and principal tags.
The solutions architect designs an IAM policy that checks if the principal tag matches the resource tag.
This dynamically restricts contractors to only start and stop EC2 instances belonging to their specific project team.
3
Verify that no administrative secrets are exposed.
Root credentials are secure, and no access keys are stored in plaintext parameters.
This guarantees compliance with SAA security guidelines and prevents unauthorized privilege escalation.

Anahtar Kavram

Attribute-Based Access Control (ABAC) and SAML 2.0 Federation
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru