DEA-C01 Question 440
Single answerYou are designing IAM policies for a data engineering team in your organization that uses AWS services extensively. The team requires fine-grained access controls to manage specific S3 buckets and DynamoDB tables. As a best practice, you want to ensure the policies are tailored to meet the team’s specific needs while maintaining manageability. Which type of IAM policy would you choose and why?
- A
AWS managed policies, because they are automatically updated by AWS to follow best practices.
- B
AWS managed policies, because they allow you to create fine-grained permissions for specific resources.
- C
Customer managed policies, because they allow you to define permissions tailored to the team's specific requirements.
- D
Customer managed policies, because they are automatically updated by AWS to include new services and features.
Show answer and explanation
Correct answer: C
Explanation
Customer managed policies are the preferred choice when you need to create tailored permissions for specific resources and users, as they provide more control and flexibility compared to AWS managed policies. While AWS managed policies are convenient and maintained by AWS, they are not customizable for use cases that require fine-grained access controls.
- A. Incorrect.
AWS managed policies are pre-built by AWS and are updated to follow best practices, but they are not customizable for specific resources or unique use cases.
- B. Incorrect.
AWS managed policies cannot provide fine-grained permissions for specific resources, as they are designed for general use cases.
- C. Correct.
Customer managed policies allow you to define tailored permissions to meet specific requirements, such as granting access to specific S3 buckets or DynamoDB tables, making them ideal in this scenario.
- D. Incorrect.
Customer managed policies are not automatically updated by AWS; the policy owner is responsible for maintaining and updating them.