DOP-C02 Question 363
Single answerYour organization uses AWS Identity and Access Management (IAM) to manage user and role permissions. You are tasked with creating a solution that allows team leads to create IAM roles for their team members, but ensures that the permissions assigned to these roles do not exceed a predefined set of permissions. Which approach should you take to achieve this?
- A
Attach a permissions boundary to the IAM roles created by team leads.
- B
Grant team leads the iam:CreateRole permission along with a permissions boundary policy attached to their IAM user.
- C
Use AWS Organizations Service Control Policies (SCPs) to limit the permissions of the IAM roles created by team leads.
- D
Create an IAM policy for team leads that explicitly denies permissions beyond the predefined set.
Show answer and explanation
Correct answer: B
Explanation
To delegate role creation with restricted permissions, you must use IAM permissions boundaries. By granting team leads the iam:CreateRole permission and specifying a permissions boundary, you ensure that any role they create cannot exceed the predefined permissions in the boundary. This approach provides fine-grained control and aligns with best practices for permission management delegation.
- A. Incorrect.
Incorrect: While attaching a permissions boundary to the IAM roles can limit their permissions, permissions boundaries must be enforced during the role-creation process, which requires proper configuration on the creator’s permissions.
- B. Correct.
Correct: Granting team leads the iam:CreateRole permission with a permissions boundary ensures that any IAM role they create cannot exceed the permissions defined in the boundary.
- C. Incorrect.
Incorrect: SCPs are used to manage permissions at the account or organizational level in AWS Organizations and cannot directly limit the permissions of IAM roles created within an account.
- D. Incorrect.
Incorrect: Denying permissions in an IAM policy for team leads would restrict their ability to perform actions themselves, but would not enforce constraints on the roles they create.