DOP-C02 Question 357
Select 2A company is building an application that requires both human users and machine processes to access AWS resources. Human users must authenticate using the company’s corporate Identity Provider (IdP) with single sign-on (SSO), while machine processes require temporary access to specific S3 buckets. How should the DevOps team configure IAM entities to meet these requirements securely?
- A
Configure an IAM role for human users and enable SAML federation with the corporate IdP.
- B
Create IAM users for human users and assign them long-term access keys.
- C
Configure an IAM policy granting appropriate S3 permissions, and attach it to an IAM user for the machine processes.
- D
Use an IAM role with a trust policy for the machine processes, and generate temporary credentials using the AssumeRole API.
- E
Enable resource-based policies on the S3 buckets to grant access to machine processes without using IAM roles.
Show answer and explanation
Correct answers: A, D
Explanation
The scenario involves both human users and machine processes accessing AWS resources. For human users, using IAM roles with SAML federation to integrate with the corporate IdP enables secure authentication and avoids the risks of managing long-term credentials. For machine processes, using IAM roles with trust policies ensures secure and temporary access to S3 buckets via the AssumeRole API. These approaches align with AWS best practices for managing human and machine access securely.
- A. Correct.
Configuring an IAM role for human users and enabling SAML federation with the corporate IdP is the best practice for integrating with an external identity provider for SSO. This avoids the need for creating IAM users and managing long-term credentials.
- B. Incorrect.
Creating IAM users with long-term access keys for human users is not recommended due to the security risks associated with long-term credentials, especially when integrating with an external IdP.
- C. Incorrect.
Attaching an IAM policy to an IAM user for machine processes is not a secure or scalable solution. Machine processes should use roles with temporary credentials instead of long-term IAM user credentials.
- D. Correct.
Using an IAM role with a trust policy for machine processes allows the generation of temporary credentials via the AssumeRole API, which is secure and aligns with AWS best practices.
- E. Incorrect.
While resource-based policies can grant access to S3 buckets, they should be used in combination with IAM roles for granting temporary access to machine processes. Using resource-based policies alone without IAM roles is not sufficient for this scenario.