DVA-C02 Question 154
Select 3Your team is working on implementing fine-grained access control for an application running on AWS. A developer suggests using AWS managed policies for all IAM roles in the application, while another suggests using customer-managed policies for certain roles. Which of the following statements are true regarding AWS managed policies and customer-managed policies?
- A
AWS managed policies are created and maintained by AWS, providing a baseline of permissions for common use cases.
- B
Customer-managed policies allow more customization and can be tailored to specific application needs.
- C
AWS managed policies can be edited to include custom permissions specific to your application.
- D
Customer-managed policies can be shared across AWS accounts using AWS Organizations.
- E
AWS managed policies automatically update to reflect changes in AWS services, ensuring compatibility.
Show answer and explanation
Correct answers: A, B, E
Explanation
AWS managed policies and customer-managed policies serve different purposes. AWS managed policies are pre-created by AWS, providing convenience and automatic updates, but they cannot be customized. Customer-managed policies, on the other hand, offer flexibility and customization to meet specific application requirements but require manual maintenance. Understanding the differences is critical for implementing the appropriate IAM strategy in your applications.
- A. Correct.
Correct: AWS managed policies are pre-created and maintained by AWS to provide general-purpose permissions for common use cases, such as granting full access to S3 or EC2.
- B. Correct.
Correct: Customer-managed policies are created by the user and can be customized to meet the specific requirements of an application or organization.
- C. Incorrect.
Incorrect: AWS managed policies are controlled by AWS and cannot be edited or customized by the user. If you need customized permissions, customer-managed policies should be used.
- D. Incorrect.
Incorrect: Customer-managed policies cannot be directly shared across AWS accounts. To share resources or permissions across accounts, you typically use AWS Organizations or resource-based policies.
- E. Correct.
Correct: AWS managed policies are automatically updated by AWS to account for updates to AWS services, ensuring they stay up to date and compatible.