DEA-C01 Question 468
Single answerA data engineering team is managing an Amazon S3 bucket that stores sensitive financial reports for different departments within a company. They need to implement role-based access control (RBAC) to ensure only authorized users can access specific folders in the bucket. The team also wants to minimize the number of policies they manage while adhering to the principle of least privilege. How should the team design the access control mechanism?
- A
Create IAM roles for each department and attach an S3 bucket policy that grants access only to the respective folders.
- B
Create a single IAM role with full access to the S3 bucket and distribute the credentials to all authorized users.
- C
Use IAM policies to define granular permissions for each user and directly attach these policies to individual IAM users.
- D
Create IAM roles for each department, attach appropriate policies to the roles, and allow users to assume the roles based on their department.
Show answer and explanation
Correct answer: D
Explanation
To implement RBAC effectively and adhere to the principle of least privilege, the best practice is to create IAM roles for each department and attach policies that define access to specific folders in the S3 bucket. Users can then assume the roles appropriate to their department, ensuring secure and scalable access management.
- A. Incorrect.
This approach violates the principle of least privilege because bucket policies apply at the bucket level and do not provide granular control over folder-specific access for each department.
- B. Incorrect.
This option is insecure and violates best practices because sharing credentials among users undermines security and accountability.
- C. Incorrect.
While this approach provides granular access, managing individual user policies is not scalable and increases administrative overhead, especially as the number of users grows.
- D. Correct.
This is the correct approach because it aligns with RBAC principles. By creating IAM roles for each department and attaching appropriate policies, access is granted based on roles rather than individual users. Users can assume roles dynamically, reducing policy management overhead.