DVA-C02 Question 144
Select 3You are designing an application that uses Amazon S3 to store files. The application has three user groups: Admins, Editors, and Viewers. Admins should have full access to the S3 bucket, Editors should be able to upload and delete files, and Viewers should only be able to read files. How can you implement role-based access control (RBAC) to meet these requirements?
- A
Create three IAM roles: Admins, Editors, and Viewers, and attach policies with the appropriate permissions to each role.
- B
Create one IAM role with a policy that grants full access to Admins, and separate permissions for Editors and Viewers.
- C
Use IAM groups for Admins, Editors, and Viewers, and attach appropriate policies to each group.
- D
Use resource-based policies on the S3 bucket to define permissions for Admins, Editors, and Viewers.
- E
Attach an inline policy to each individual user account to define their access level.
Show answer and explanation
Correct answers: A, C, D
Explanation
Role-based access control (RBAC) in AWS can be implemented using IAM roles, IAM groups, or resource-based policies. IAM roles allow you to define specific permissions and assign them to users or services. IAM groups enable you to group users and apply policies at the group level. Resource-based policies are another option to directly define access permissions on the resource, such as an S3 bucket. Attaching inline policies to individual users is not recommended due to poor scalability and management complexity.
- A. Correct.
Correct. Using IAM roles with policies is a common and scalable way to implement RBAC. Each role can be assigned to users or services requiring specific permissions.
- B. Incorrect.
Incorrect. Using a single IAM role with combined permissions is not a best practice for RBAC, as it lacks clear separation of responsibilities and permissions.
- C. Correct.
Correct. IAM groups are another way to implement RBAC by grouping users and assigning them the necessary permissions through policies.
- D. Correct.
Correct. Resource-based policies on the S3 bucket can directly control access levels for Admins, Editors, and Viewers, ensuring fine-grained access control.
- E. Incorrect.
Incorrect. Attaching inline policies to individual user accounts is not recommended for RBAC, as it is difficult to manage and does not scale well.