SCS-C02 Question 442
Select 3An organization, Organization A, wants to provide temporary access to its Amazon S3 bucket to an external partner, Organization B. Organization A wants to ensure that the access is granted securely and that Organization B can only perform specific actions on the bucket. Which of the following steps must Organization A take to securely set up cross-account access using an IAM role?
- A
Create an IAM role in Organization A's account and define a trust policy that allows Organization B's AWS account to assume the role.
- B
Attach a policy to the IAM role in Organization A's account that specifies the permissions for accessing the S3 bucket.
- C
Create an IAM role in Organization B's account and attach a policy that grants permissions to access Organization A's S3 bucket.
- D
Provide Organization B with the ARN of the IAM role in Organization A's account so they can assume the role.
- E
Enable cross-region replication on the S3 bucket in Organization A's account to allow access for Organization B.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely set up cross-account access using an IAM role, Organization A must create an IAM role in its account, define a trust policy to allow Organization B to assume the role, and attach a policy specifying the permissions for accessing the S3 bucket. Organization B must then use the ARN of the IAM role to assume it. This process ensures secure and controlled access to the S3 bucket.
- A. Correct.
Correct: Organization A must create an IAM role in its account and define a trust policy that allows Organization B's AWS account to assume the role. This is a fundamental step in setting up cross-account access.
- B. Correct.
Correct: The permissions for accessing the S3 bucket must be explicitly defined in a policy attached to the IAM role in Organization A's account. This ensures that Organization B can only perform the intended actions.
- C. Incorrect.
Incorrect: The IAM role should be created in Organization A's account, not in Organization B's account, as the access is being granted by Organization A.
- D. Correct.
Correct: Organization B needs the ARN of the IAM role in Organization A's account to assume the role. This is how they authenticate themselves to perform actions on the S3 bucket.
- E. Incorrect.
Incorrect: Cross-region replication is unrelated to IAM roles and cross-account access. It is a feature for replicating data between S3 buckets in different AWS regions.