DOP-C02 Question 366
Single answerYour organization has a centralized AWS account that manages IAM roles and enforces strict security policies. You want to delegate permission management for a specific set of resources in a development environment to a team without allowing them to escalate their privileges or modify permissions outside of their scope. How can you achieve this using IAM permission boundaries?
- A
Attach an IAM policy with the required permissions to the users and roles in the team.
- B
Use an IAM permissions boundary to define the maximum permissions the team can grant to roles they create or manage.
- C
Create a Service Control Policy (SCP) to restrict permissions for the team at the account level.
- D
Grant the team administrative access to manage their roles and resources independently.
Show answer and explanation
Correct answer: B
Explanation
IAM permissions boundaries are designed to set the maximum permissible actions for roles and users the team manages, without granting unrestricted permissions. By using a permissions boundary, you can delegate permission management to a team while ensuring they cannot exceed the specified scope, effectively preventing privilege escalation. This makes them the ideal tool for managing permissions in this scenario.
- A. Incorrect.
Attaching an IAM policy directly to users or roles provides permissions but does not restrict the scope of what new roles the team might create or manage. This does not fulfill the requirement to prevent privilege escalation.
- B. Correct.
IAM permissions boundaries allow you to delegate permission management while ensuring that the team cannot exceed the permissions defined in the boundary. This is the correct approach for this scenario.
- C. Incorrect.
Service Control Policies (SCPs) are used to manage permissions at the organization or account level in AWS Organizations. While SCPs can restrict permissions, they do not provide the granularity required for delegating specific permissions within a single account.
- D. Incorrect.
Granting administrative access to the team provides them unrestricted control over their roles and resources, which violates the requirement to prevent privilege escalation.