Topic 1 Question 261
A company has an organization in AWS Organizations. A DevOps engineer needs to maintain multiple AWS accounts that belong to different OUs in the organization. All resources, including IAM policies and Amazon S3 policies within an account, are deployed through AWS CloudFormation. All templates and code are maintained in an AWS CodeCommit repository. Recently, some developers have not been able to access an S3 bucket from some accounts in the organization.
The following policy is attached to the S3 bucket:
What should the DevOps engineer do to resolve this access issue?
Modify the S3 bucket policy. Turn off the S3 Block Public Access setting on the S3 bucket. In the S3 policy, add the aws:SourceAccount condition. Add the AWS account IDs of all developers who are experiencing the issue.
Verify that no IAM permissions boundaries are denying developers access to the S3 bucket. Make the necessary changes to IAM permissions boundaries. Use an AWS Config recorder in the individual developer accounts that are experiencing the issue to revert any changes that are blocking access. Commit the fix back into the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
Configure an SCP that stops anyone from modifying IAM resources in developer OUs. In the S3 policy, add the aws:SourceAccount condition. Add the AWS account IDs of all developers who are experiencing the issue. Commit the fix back into the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
Ensure that no SCP is blocking access for developers to the S3 bucket. Ensure that no IAM policy permissions boundaries are denying access to developer IAM users. Make the necessary changes to the SCP and IAM policy permissions boundaries in the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
ユーザの投票
コメント(4)
- 正解だと思う選択肢: D
Option D is the most comprehensive and aligns with the requirements:
- It ensures that both SCPs and IAM policies are correctly configured.
- It adheres to the use of CloudFormation for all changes.
- It addresses the immediate issue while providing a scalable and manageable approach.
👍 5trungtd2024/07/14 - 正解だと思う選択肢: D
---> D
👍 4tgv2024/07/15 - 正解だと思う選択肢: D
- Comprehensive approach: Reviews both SCPs and IAM permissions boundaries that could block access.
- Changes are committed to CodeCommit and deployed through CloudFormation, maintaining the required deployment pipeline.
- By checking both SCPs and permissions boundaries, this solution covers potential organizational and account-level restrictions that could impact access.
👍 4jamesf2024/07/31
シャッフルモード