DOP-C02 Question 347
Select 2Your organization has multiple AWS accounts managed under AWS Organizations. To simplify identity management, you are tasked with providing developers across all accounts access to an Amazon S3 bucket in a shared services account. The solution must be secure, scalable, and reduce operational overhead. Which combination of steps should you take to achieve this?
- A
Use AWS SSO with a permission set granting access to the S3 bucket and assign it to the developer groups in each account.
- B
Create an IAM role in the shared services account with a trust policy allowing access from the other accounts and grant the required permissions for the S3 bucket.
- C
Manually create IAM users in each account and attach a policy granting access to the S3 bucket in the shared services account.
- D
Use AWS Resource Access Manager (RAM) to share the S3 bucket directly with the other AWS accounts.
- E
Configure cross-account IAM roles in each account that allow developers to assume a role in the shared services account with access to the S3 bucket.
Show answer and explanation
Correct answers: B, E
Explanation
The most secure and scalable approach for managing identity and access management at scale in a multi-account AWS environment is to use cross-account IAM roles. By creating a role in the shared services account with a trust policy for the other accounts (Option 2) and configuring cross-account IAM roles in each account to assume this shared role (Option 5), you can provide developers access to the S3 bucket securely. This approach minimizes operational overhead and adheres to best practices for identity and access management.
- A. Incorrect.
AWS SSO can simplify identity management, but it doesn't directly address cross-account access to an S3 bucket. This option alone is insufficient for the scenario.
- B. Correct.
Creating an IAM role in the shared services account with a trust policy for cross-account access is a secure and scalable method. It allows other accounts to assume this role and gain access to the S3 bucket.
- C. Incorrect.
Manually creating IAM users in each account is not scalable or secure at scale, especially in a multi-account scenario.
- D. Incorrect.
AWS RAM is used for sharing specific AWS resources like subnets or Transit Gateway attachments. It does not support sharing S3 buckets directly.
- E. Correct.
Configuring cross-account IAM roles in each account to assume a role in the shared services account is a scalable and secure way to grant access in a multi-account setup.