DEA-C01 Question 442
Single answerA data engineering team is tasked with defining IAM permissions for a data pipeline in AWS. The team wants to use a policy that provides fine-grained control over specific actions for their resources. Additionally, they want to ensure the policy can be customized and updated as the project evolves. Which type of policy should they use?
- A
AWS managed policies
- B
Customer managed policies
- C
Inline policies
- D
Service control policies (SCPs)
Show answer and explanation
Correct answer: B
Explanation
Customer managed policies are the best choice when you need fine-grained control over permissions and the ability to customize and update policies to meet specific requirements. AWS managed policies are pre-defined and cannot be modified, while inline policies are less reusable and scalable. Service control policies (SCPs) are used for governance across AWS accounts, not for managing permissions for a specific resource or pipeline.
- A. Incorrect.
AWS managed policies are pre-defined by AWS and cannot be customized, which makes them unsuitable for scenarios requiring fine-grained or evolving permissions.
- B. Correct.
Customer managed policies are fully customizable IAM policies created and managed by the customer. They allow for fine-grained control and can be updated as needed, making them the best choice for this scenario.
- C. Incorrect.
Inline policies are directly attached to a single IAM user, group, or role, and are not reusable or scalable. While they allow fine-grained control, they are not ideal for broader use cases like a data pipeline.
- D. Incorrect.
Service control policies (SCPs) are used with AWS Organizations to manage permissions at the account or organizational level, not for specific IAM users, roles, or resources. They are not relevant to this scenario.