CLF-C02 Question 98
Select 3An organization wants to ensure secure access to its AWS resources. They need to grant developers permissions to specific services while ensuring the principle of least privilege. Which AWS access management capabilities should they use to achieve this?
- A
Use IAM roles to assign temporary credentials for accessing AWS services
- B
Define IAM policies to explicitly allow only the required actions on resources
- C
Use AWS Organizations to create a hierarchy of accounts with pre-defined permissions
- D
Enable multi-factor authentication (MFA) for all users
- E
Create IAM groups to manage permissions for multiple users at once
Show answer and explanation
Correct answers: A, B, E
Explanation
To achieve secure access and adhere to the principle of least privilege, the organization should use IAM roles for temporary credentials, define IAM policies for fine-grained permissions, and use IAM groups for efficient permission management. These capabilities ensure that developers have access only to what they need while maintaining security best practices.
- A. Correct.
IAM roles allow you to grant temporary access to specific AWS services and resources without sharing long-term credentials, aligning with security best practices.
- B. Correct.
IAM policies enable fine-grained access control by explicitly defining which actions are allowed or denied on AWS resources, supporting the principle of least privilege.
- C. Incorrect.
AWS Organizations is used for managing multiple AWS accounts and applying Service Control Policies (SCPs), but it is not directly used for granting permissions to individual developers.
- D. Incorrect.
While MFA enhances account security, it does not directly manage or grant access permissions to AWS resources.
- E. Correct.
IAM groups simplify access management by allowing you to assign permissions to multiple users at once, ensuring consistency and adherence to least privilege.