SAP-C02 Question 227
Select 3Your company has multiple AWS accounts managed under AWS Organizations. You need to set up cross-account access to allow developers in the 'Development' account to assume a role in the 'Production' account to perform specific actions on an S3 bucket. What steps must you take to achieve this securely?
- A
Create an IAM role in the Production account with a trust policy allowing the Development account to assume the role.
- B
Attach an inline policy to the IAM role in the Production account granting the required permissions to access the S3 bucket.
- C
Create an IAM user in the Development account and attach a policy that allows the user to assume the role in the Production account.
- D
Update the bucket policy on the S3 bucket in the Production account to explicitly allow access for the IAM role.
- E
Add the 'sts:AssumeRole' action to the IAM policy of the developers in the Development account to allow them to assume the role in the Production account.
Show answer and explanation
Correct answers: A, B, E
Explanation
To securely enable cross-account access between the Development and Production accounts, you must set up an IAM role in the Production account with a trust policy allowing the Development account to assume the role. The role must also have an inline or managed policy granting the required permissions for the S3 bucket. Additionally, the developers in the Development account need an IAM policy with the 'sts:AssumeRole' action to assume the role in the Production account. Together, these steps ensure secure and controlled cross-account access.
- A. Correct.
Correct. The IAM role in the Production account must have a trust policy that explicitly allows the Development account to assume the role. This is a required step for cross-account access.
- B. Correct.
Correct. The IAM role in the Production account must have the necessary permissions (via an inline or managed policy) to perform actions on the S3 bucket. Without such permissions, the role cannot perform the required operations.
- C. Incorrect.
Incorrect. Creating an IAM user in the Development account is unnecessary for this scenario. Cross-account access is achieved using roles, not users.
- D. Incorrect.
Incorrect. Updating the bucket policy is not a required step in this scenario since the role permissions and trust relationship cover the access requirements. Modifying the bucket policy is redundant if the role is configured correctly.
- E. Correct.
Correct. Developers in the Development account need an IAM policy that grants them the ability to assume the role in the Production account using the 'sts:AssumeRole' action.