SAA-C03 Question 5
Select 3A company wants to provide secure access for its developers to manage resources in an AWS account. The developers should only be able to access specific services and actions based on their job roles. Additionally, the company wants to ensure that access keys are not hardcoded into applications or shared manually. Which of the following solutions would meet these requirements?
- A
Create IAM roles with policies that grant the necessary permissions and allow developers to assume these roles.
- B
Create IAM users for each developer, attach policies with required permissions, and share long-term access keys with them.
- C
Use AWS Systems Manager Session Manager to provide secure access to AWS resources without the need for SSH keys or bastion hosts.
- D
Enable Multi-Factor Authentication (MFA) for IAM users and enforce its use for all AWS Management Console logins.
- E
Use Amazon Cognito to manage user identities and their access to AWS resources.
Show answer and explanation
Correct answers: A, C, D
Explanation
To design secure access to AWS resources, you should use IAM roles with policies for granting temporary permissions, enforce MFA to enhance account security, and leverage Systems Manager Session Manager for secure access. Sharing long-term credentials or using inappropriate services like Cognito for this purpose is not recommended.
- A. Correct.
Creating IAM roles with policies and allowing developers to assume these roles ensures secure, temporary access to AWS resources without the need to share long-term credentials. This aligns with AWS best practices.
- B. Incorrect.
Creating IAM users and sharing long-term access keys is not secure. Hardcoding or sharing access keys increases the risk of security breaches and violates AWS best practices.
- C. Correct.
AWS Systems Manager Session Manager provides secure, auditable session access to manage AWS resources, avoiding the need for SSH keys or bastion hosts, which enhances security.
- D. Correct.
Enabling MFA for IAM users adds an extra layer of security, ensuring that even if credentials are compromised, unauthorized access is prevented.
- E. Incorrect.
Amazon Cognito is designed for managing user identities for web and mobile applications, not for granting secure access to AWS resources for developers.