SCS-C02 Question 280
Select 3A company is using an Amazon S3 bucket to store sensitive data. They want to ensure that only users authenticated via their corporate Identity Provider (IdP) can access the bucket. The users should assume a specific IAM role to gain access. Which steps should the company implement to achieve this?
- A
Set up a SAML-based federation between the corporate IdP and AWS.
- B
Configure an IAM policy on the S3 bucket to allow access to the specific IAM role.
- C
Enable Multi-Factor Authentication (MFA) for all users in the corporate IdP to secure their access.
- D
Create a trust relationship in the IAM role to allow the IdP to assume the role.
- E
Generate long-term access keys for users and distribute them for S3 bucket access.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely enable access to an S3 bucket for users authenticated via a corporate IdP, the company must set up a SAML-based federation to integrate the IdP with AWS. This allows users to authenticate with their corporate credentials. The IAM role needs a trust policy to allow the IdP to assume the role, and the S3 bucket must have a policy granting necessary permissions to the role. MFA, while highly recommended, is not specifically required in this scenario, and distributing long-term access keys should be avoided as it violates AWS best practices.
- A. Correct.
Correct. SAML-based federation allows the corporate IdP to authenticate users and pass their credentials to AWS securely.
- B. Correct.
Correct. An appropriate IAM policy must be attached to the S3 bucket to allow access for the IAM role being assumed by the authenticated users.
- C. Incorrect.
Incorrect. While enabling MFA is a good security practice, it is not a required step to enable authentication for the S3 bucket in this scenario.
- D. Correct.
Correct. The IAM role must have a trust relationship to permit the corporate IdP to assume the role on behalf of the authenticated users.
- E. Incorrect.
Incorrect. Distributing long-term access keys is against AWS security best practices and is not necessary when IAM roles and temporary credentials are used.