SCS-C02 Question 440
Select 3A company has two AWS accounts: 'Account A' and 'Account B'. Account A hosts an S3 bucket that contains sensitive data, and the company wants to allow specific users from Account B to access this bucket securely. The solution should ensure least privilege and allow users in Account B to assume a role in Account A to access the bucket. Which of the following steps are required to implement this setup?
- A
Create an IAM role in Account A with a trust policy that allows Account B to assume the role.
- B
Attach an inline policy to the IAM role in Account A granting permissions to the S3 bucket.
- C
Create an IAM user in Account B and attach a policy granting permissions to assume the role in Account A.
- D
Configure a resource-based policy on the S3 bucket in Account A to allow access for the IAM role.
- E
Update the default AWS Organizations Service Control Policy (SCP) to allow cross-account access.
Show answer and explanation
Correct answers: A, B, C
Explanation
To securely allow cross-account access to an S3 bucket, you need to set up an IAM role in Account A that trusts Account B. This role must have permissions to the S3 bucket and must be assumable by users in Account B. In addition, users in Account B need permissions to assume the role in Account A. Resource-based policies and SCPs are not necessary in this specific scenario since the role-based approach is sufficient for enforcing least privilege.
- A. Correct.
Correct. The IAM role in Account A must explicitly trust Account B to allow users from Account B to assume the role.
- B. Correct.
Correct. The IAM role in Account A must have permissions to access the S3 bucket in order to grant access to users assuming the role.
- C. Correct.
Correct. Users in Account B need permissions to assume the IAM role in Account A, which can be achieved by attaching a policy to them.
- D. Incorrect.
Incorrect. While resource-based policies can be used for cross-account access, they are not required in this scenario since the access will be delegated through an IAM role.
- E. Incorrect.
Incorrect. SCPs in AWS Organizations are used to set account-wide permission boundaries, but they don't directly enable cross-account role access.