DVA-C02 Question 156
Single answerA developer is setting up IAM permissions for a new application in AWS. The developer wants to use a policy that allows them to define fine-grained permissions tailored to the application's specific needs. However, they also need to ensure that the policy can be easily updated by their team without relying on AWS-provided default policies. What type of policy should they use?
- A
AWS managed policy
- B
Customer-managed policy
- C
Inline policy
- D
Service control policy (SCP)
Show answer and explanation
Correct answer: B
Explanation
Customer-managed policies are the best choice in this scenario because they allow the developer to define fine-grained, reusable permissions tailored to the application's needs. Unlike AWS managed policies, customer-managed policies are fully customizable and can be updated by the team, providing the flexibility required in the given situation.
- A. Incorrect.
AWS managed policies are pre-created by AWS and cannot be customized. They may not provide the fine-grained, specific permissions required for the developer's application.
- B. Correct.
Customer-managed policies are created and managed by the customer, allowing for fine-grained permissions tailored to specific application requirements. They can also be updated by the customer's team, making them suitable for this scenario.
- C. Incorrect.
Inline policies are directly attached to an IAM user, group, or role and are not reusable. While they allow fine-grained permissions, they are not ideal for general-purpose or reusable policies and don't meet the requirements specified in the scenario.
- D. Incorrect.
Service control policies (SCPs) are used to manage permissions across AWS Organizations accounts and are not applicable for defining application-specific permissions.