SCS-C02 Question 441
Select 2An organization named OrgA wants to allow an external partner, OrgB, to access an S3 bucket in its AWS account. OrgA wants to ensure that OrgB has temporary access to the bucket, with permissions limited to reading objects. Which of the following steps should OrgA take to securely grant this access?
- A
Create an IAM role in OrgA's account with a trust policy allowing OrgB's AWS account ID, and attach a policy to the role granting read-only access to the S3 bucket.
- B
Share the IAM credentials of an OrgA user with read-only permissions to the S3 bucket directly with OrgB.
- C
Provide OrgB with the ARN of the IAM role and instruct them to assume the role using their own AWS account.
- D
Add OrgB's AWS account ID to the S3 bucket's Bucket Policy, granting read-only access to the bucket.
- E
Attach an inline policy to OrgB's IAM user granting access to OrgA's S3 bucket.
Show answer and explanation
Correct answers: A, C
Explanation
When granting cross-account access to an S3 bucket, the most secure approach is to create an IAM role in OrgA's account with a trust policy that allows OrgB to assume the role. By attaching a policy to the role that grants read-only access to the bucket, OrgA ensures that permissions are limited. OrgB can then assume the role using its own AWS account, gaining temporary and restricted access to the bucket. This approach follows AWS security best practices.
- A. Correct.
Correct. Creating an IAM role with a trust policy for OrgB and attaching a read-only policy is the recommended way to securely manage cross-account access.
- B. Incorrect.
Incorrect. Sharing IAM user credentials directly is a violation of AWS security best practices and introduces significant security risks.
- C. Correct.
Correct. Providing OrgB with the ARN of the role allows them to assume the role and gain temporary, restricted access to the resources.
- D. Incorrect.
Incorrect. While bucket policies can be used for cross-account access, it is less secure and does not provide temporary, restricted access, which is required in this scenario.
- E. Incorrect.
Incorrect. OrgB's IAM user cannot be directly attached to OrgA's resources. IAM policies are account-specific and cannot be used to grant cross-account access directly.