DOP-C02 Question 355
Select 2Your organization uses AWS to host a multi-tier application. You need to design an IAM strategy that ensures secure and appropriate access for both human users (developers and administrators) and machine-based workloads (microservices and backend systems). The organization wants to follow the principle of least privilege and ensure that permissions are scoped appropriately. Which of the following actions should you take to meet these requirements? (Select TWO.)
- A
Use IAM roles with instance profiles to provide temporary credentials for EC2-based backend services.
- B
Create IAM users with long-term access keys for each developer and assign permissions directly to these users.
- C
Use an identity provider (IdP) to federate access for developers and administrators and assign permissions via roles.
- D
Attach resource-based policies directly to S3 buckets to grant access to specific backend services.
- E
Attach inline policies directly to developers' IAM users for managing permissions.
Show answer and explanation
Correct answers: A, C
Explanation
The principle of least privilege and secure access mechanisms are critical in IAM design. Using IAM roles with instance profiles enables machine-based workloads like EC2 instances to obtain temporary credentials, eliminating the need for hard-coded or long-term credentials. For human users, federated access through an identity provider (IdP) allows for centralized authentication and short-term role assumption, ensuring secure and manageable access control. The other options either violate best practices or do not fully meet the specified requirements.
- A. Correct.
Correct. IAM roles with instance profiles allow EC2 instances or backend services to assume roles and get temporary credentials, adhering to the principle of least privilege while avoiding long-term credentials.
- B. Incorrect.
Incorrect. Creating IAM users with long-term access keys for developers is not recommended because it increases the risk of key compromise and does not align with best practices for human access control.
- C. Correct.
Correct. Using an identity provider (IdP) for federated access allows developers and administrators to assume roles for temporary access, which is secure and aligns with the principle of least privilege.
- D. Incorrect.
Incorrect. While resource-based policies can be used to grant access to S3 buckets, they are not required in this scenario unless specific cross-account access or service-level access is needed, which is not mentioned here.
- E. Incorrect.
Incorrect. Assigning inline policies directly to IAM users is not a scalable or recommended practice. Instead, policies should be attached at a group or role level to ensure manageability and adherence to best practices.