DVA-C02 Question 150
Single answerA developer is working on an application hosted in AWS that requires access to an S3 bucket to read and write files. The developer wants to ensure the application adheres to the principle of least privilege. What is the BEST way to achieve this?
- A
Attach an AmazonS3FullAccess managed policy to the application's IAM role.
- B
Create a custom IAM policy that allows only the necessary read and write actions for specific objects in the S3 bucket and attach it to the application's IAM role.
- C
Attach an AdministratorAccess managed policy to the application's IAM role.
- D
Use a bucket policy to grant public read and write access to the S3 bucket.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege dictates that permissions should be limited to the minimum necessary for a task. Creating a custom IAM policy that grants only the required permissions for specific objects in the S3 bucket ensures that the application has the access it needs without exposing unnecessary permissions or security risks.
- A. Incorrect.
This option grants full access to all S3 buckets and actions, which violates the principle of least privilege by providing unnecessary permissions.
- B. Correct.
This option adheres to the principle of least privilege by granting only the specific permissions required for the application to perform its tasks on specific objects in the S3 bucket.
- C. Incorrect.
This option grants full access to all AWS resources, which is overly permissive and violates the principle of least privilege.
- D. Incorrect.
Granting public read and write access to the S3 bucket poses a significant security risk and does not adhere to the principle of least privilege.