Topic 1 Question 177
A security engineer is designing an IAM policy for a script that will use the AWS CLI. The script currently assumes an IAM role that is attached to three AWS managed IAM policies: AmazonEC2FullAccess, AmazonDynamoDBFullAccess, and AmazonVPCFullAccess.
The security engineer needs to construct a least privilege IAM policy that will replace the AWS managed IAM policies that are attached to this role.
Which solution will meet these requirements in the MOST operationally efficient way?
In AWS CloudTrail, create a trail for management events. Run the script with the existing AWS managed IAM policies. Use IAM Access Analyzer to generate a new IAM policy that is based on access activity in the trail. Replace the existing AWS managed IAM policies with the generated IAM policy for the role.
Remove the existing AWS managed IAM policies from the role. Attach the IAM Access Analyzer Role Policy Generator to the role. Run the script. Return to IAM Access Analyzer and generate a least privilege IAM policy. Attach the new IAM policy to the role.
Create an account analyzer in IAM Access Analyzer. Create an archive rule that has a filter that checks whether the PrincipalArn value matches the ARN of the role. Run the script. Remove the existing AWS managed IAM policies from the role.
In AWS CloudTrail, create a trail for management events. Remove the existing AWS managed IAM policies from the role. Run the script. Find the authorization failure in the trail event that is associated with the script. Create a new IAM policy that includes the action and resource that caused the authorization failure. Repeat the process until the script succeeds. Attach the new IAM policy to the role.
ユーザの投票
コメント(3)
Option A provides the most operationally efficient solution by leveraging AWS CloudTrail to log access activity and IAM Access Analyzer to automatically generate a least privilege policy based on that activity. This approach minimizes manual intervention and ensures that the resulting IAM policy grants only the permissions necessary for the script to function, adhering to the principle of least privilege.
👍 2mikelord2024/10/02- 👍 2VPNalumni2024/10/11
- 正解だと思う選択肢: A
The most operationally efficient way to construct a least privilege IAM policy for the script is Option A:
A. In AWS CloudTrail, create a trail for management events. Run the script with the existing AWS managed IAM policies. Use IAM Access Analyzer to generate a new IAM policy that is based on access activity in the trail. Replace the existing AWS managed IAM policies with the generated IAM policy for the role.
AWS CloudTrail logs all API calls, which provides a comprehensive record of the actions performed by the script. IAM Access Analyzer can analyze these logs to automatically generate a least privilege policy based on the actual access patterns1. This minimizes the manual effort required to identify necessary permissions. This approach ensures that the new policy includes only the permissions that are actually used, adhering to the principle of least privilege.
👍 1IPLogic2024/12/03
シャッフルモード