DVA-C02 Question 142
Single answerA company is using AWS to host its application. The development team is required to access resources such as Amazon S3 buckets and DynamoDB tables, while the operations team needs access to manage EC2 instances and CloudWatch. The company wants to implement Role-Based Access Control (RBAC) to ensure each team has only the permissions necessary for their tasks. Which approach should the company take to configure RBAC effectively?
- A
Create two IAM policies: one granting permissions to resources required by the development team and another granting permissions to resources required by the operations team. Attach these policies to their respective IAM roles.
- B
Grant both the development and operations teams full administrator access to simplify access management and avoid delays in workflow.
- C
Assign all users in the development and operations teams to the same IAM group and attach a single policy granting permissions to all required resources.
- D
Use AWS Organizations to create service control policies (SCPs) that restrict access to certain services globally, and apply these SCPs to the development and operations teams.
Show answer and explanation
Correct answer: A
Explanation
Role-Based Access Control (RBAC) ensures that users or groups are granted permissions only for the tasks they need to perform. By creating separate IAM policies for the development and operations teams and attaching them to respective IAM roles, the company adheres to the principle of least privilege and maintains clear permission boundaries. This approach minimizes security risks and simplifies access management.
- A. Correct.
This is the correct approach. Creating separate IAM policies for each team's specific needs and attaching them to respective IAM roles ensures that each team has the minimum permissions they require, adhering to the principle of least privilege.
- B. Incorrect.
This is incorrect. Granting full administrator access violates the principle of least privilege and increases the risk of accidental or malicious changes to critical resources.
- C. Incorrect.
This is incorrect. Grouping both teams together and using a single policy would not enforce role-based access control since both teams would have access to resources they do not require, violating the principle of least privilege.
- D. Incorrect.
This is incorrect. While SCPs are useful for managing permissions at the AWS Organizations level, they are not designed for fine-grained, role-based access control for specific teams within an account.