SAP-C02 Question 422
Single answerYour organization is using AWS IAM to manage access to its resources. A developer needs access to an Amazon S3 bucket to upload logs from their application, but should not have access to delete the bucket or modify its policies. As a solutions architect, how can you ensure the principle of least privilege is adhered to in this scenario?
- A
Attach the AmazonS3FullAccess managed policy to the developer's IAM role.
- B
Create a custom IAM policy that grants the developer permission to perform only the PutObject and GetObject actions on the specific S3 bucket.
- C
Attach the AmazonS3ReadOnlyAccess managed policy to the developer's IAM role.
- D
Use a bucket policy to deny all actions except PutObject for the developer.
Show answer and explanation
Correct answer: B
Explanation
Adhering to the principle of least privilege requires granting only the specific permissions needed to perform a task. In this scenario, the developer only needs PutObject and possibly GetObject permissions for a specific S3 bucket. Creating a custom IAM policy ensures that access is restricted to the necessary actions on the specific bucket, minimizing the risk of unauthorized or inadvertent actions on other AWS resources.
- A. Incorrect.
This option violates the principle of least privilege because the AmazonS3FullAccess policy grants full access to S3 resources, including permissions to delete buckets and modify bucket policies, which the developer does not need.
- B. Correct.
This option adheres to the principle of least privilege by granting only the necessary permissions (PutObject and GetObject) for the specific S3 bucket, ensuring the developer cannot perform actions beyond what is required.
- C. Incorrect.
This option provides only read access to the bucket, which does not meet the developer's requirement to upload logs. Additionally, it may grant unnecessary read access to other S3 resources, violating the principle of least privilege.
- D. Incorrect.
While this option restricts other actions, it does not explicitly allow the GetObject action, which may be required for the developer to verify uploaded files. Moreover, using bucket policies alone for this use case is less granular and harder to manage compared to IAM policies.