SAP-C02 Question 423
Single answerAn organization is using AWS to host its multi-account architecture. The security team has mandated that IAM policies across all accounts must adhere to the principle of least privilege. A developer needs to create an IAM policy that grants access to an S3 bucket for uploading logs. Which of the following policy options aligns with the principle of least privilege?
- A
Grant full access to all S3 actions on the bucket.
- B
Grant access to the specific action 's3:PutObject' on the bucket and its objects.
- C
Grant access to all S3 actions globally and add a condition to allow access only from the organization's IP range.
- D
Grant access to the specific action 's3:*' on the bucket and its objects.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege states that users, systems, or applications should be granted only the permissions they need to perform their tasks and no more. In this scenario, the developer requires access only to the 's3:PutObject' action for uploading logs to the S3 bucket. Granting broader permissions, such as access to all S3 actions, even with conditions or scoping to a bucket, violates this principle. Therefore, the correct option is to grant access only to the required action, 's3:PutObject'.
- A. Incorrect.
This option violates the principle of least privilege as it grants full access to all S3 actions, including actions like deleting or listing objects, which are not required by the developer for uploading logs.
- B. Correct.
This option adheres to the principle of least privilege by granting access only to the specific action 's3:PutObject', which is needed for uploading logs. It ensures that the developer cannot perform any unnecessary or unintended actions.
- C. Incorrect.
While adding a condition can restrict access to a specific IP range, this option still violates the principle of least privilege because it grants access to all S3 actions globally, many of which are not required for uploading logs.
- D. Incorrect.
This option grants all S3 actions ('s3:*') on the specific bucket and its objects. However, this still violates the principle of least privilege because it includes actions beyond what is required for uploading logs.