CLF-C02 Question 108
Select 2An organization wants to grant developers access to a specific S3 bucket in their AWS account. The developers should only be able to upload files to the bucket and not delete or modify any existing files. Which of the following configurations aligns with the principle of least privilege?
- A
Create an IAM group for developers, attach a managed policy granting full access to the S3 service.
- B
Create an IAM group for developers, attach a custom policy that grants 's3:PutObject' permission for the specific S3 bucket.
- C
Attach a managed policy to each individual developer's IAM user, granting 's3:PutObject' and 's3:DeleteObject' permissions for the specific S3 bucket.
- D
Create an IAM group for developers, attach a custom policy that grants 's3:PutObject' permission and explicitly denies 's3:DeleteObject' for the specific S3 bucket.
- E
Assign the 'AdministratorAccess' managed policy to the IAM group for developers to ensure they can perform all necessary actions.
Show answer and explanation
Correct answers: B, D
Explanation
The principle of least privilege dictates that users and groups should only be granted the minimum permissions necessary to perform their job functions. Options 2 and 4 align with this principle by granting only the required permissions ('s3:PutObject') for the specific S3 bucket and, in the case of Option 4, explicitly denying unnecessary permissions ('s3:DeleteObject'). The other options grant excessive or irrelevant permissions, violating the principle of least privilege.
- A. Incorrect.
This option violates the principle of least privilege because it grants developers full access to the entire S3 service, not just the specific actions required for the bucket in question.
- B. Correct.
This option adheres to the principle of least privilege by granting only the required 's3:PutObject' permission for the specific S3 bucket.
- C. Incorrect.
This option violates the principle of least privilege because it grants additional permissions ('s3:DeleteObject') that are not required.
- D. Correct.
This option aligns with the principle of least privilege by granting only the required 's3:PutObject' permission and explicitly denying unnecessary permissions ('s3:DeleteObject').
- E. Incorrect.
This option violates the principle of least privilege because it grants excessive permissions ('AdministratorAccess') that far exceed what is needed for the task.