SAA-C03 Question 8
Select 2A company wants to grant its development team access to specific Amazon S3 buckets while ensuring that the team cannot access other resources in the AWS account. The team members should authenticate using their corporate Active Directory credentials. Which solution will meet these requirements in the most secure and efficient way?
- A
Use AWS Identity and Access Management (IAM) users with bucket policies attached to each S3 bucket.
- B
Set up AWS Single Sign-On (AWS SSO) integrated with the corporate Active Directory, and assign permissions to access the S3 buckets through IAM roles.
- C
Create an IAM policy allowing access to specific S3 buckets, attach it directly to each developer, and enable multi-factor authentication (MFA).
- D
Use an identity provider (IdP) federation with SAML, create IAM roles granting access to the S3 buckets, and map the roles to permissions based on Active Directory groups.
Show answer and explanation
Correct answers: B, D
Explanation
To design secure access to AWS resources, integrating with the corporate Active Directory ensures that the development team can authenticate using their existing credentials. Using AWS SSO or SAML-based federation with an IdP provides a scalable and secure way to grant access to specific resources, such as Amazon S3 buckets, through IAM roles. Options 2 and 4 meet all requirements while adhering to AWS security best practices.
- A. Incorrect.
This option can work, but managing individual IAM users and bucket policies for each team member is not scalable or efficient. It also does not integrate well with corporate Active Directory for authentication.
- B. Correct.
This option is correct because AWS SSO allows integration with corporate Active Directory and provides a scalable way to manage access to AWS resources like S3 buckets through IAM roles.
- C. Incorrect.
While this approach can restrict access to specific S3 buckets, attaching policies directly to individual users is not a best practice. It is also not efficient for large teams and does not align with the requirement to use corporate Active Directory credentials.
- D. Correct.
This option is correct because using SAML-based federation with an IdP allows the company to integrate corporate Active Directory for authentication. IAM roles mapped to Active Directory groups provide secure and scalable access to the required S3 buckets.