Topic 1 Question 179
A company has two AWS accounts: Account A and Account B. Account A has an IAM role that IAM users in Account B assume when they need to upload sensitive documents to Amazon S3 buckets in Account A.
A new requirement mandates that users can assume the role only if they are authenticated with multi-factor authentication (MFA). A security engineer must recommend a solution that meets this requirement with minimum risk and effort.
Which solution should the security engineer recommend?
Add an aws:MultiFactorAuthPresent condition to the role's permissions policy.
Add an aws MultiFactorAuthPresent condition to the role’s trust policy.
Add an aws:MultiFactorAuthPresent condition to the session policy.
Add an aws:MultiFactorAuthPresent condition to the S3 bucket policies.
ユーザの投票
コメント(3)
Option B is the correct answer because adding the aws:MultiFactorAuthPresent condition to the role's trust policy enforces MFA for role assumption, ensuring that only users who have authenticated with MFA can assume the role. This solution meets the requirement effectively and with minimal changes.
👍 3mikelord2024/10/02- 正解だと思う選択肢: B
I think about Trust policy as a "Resource Policy" for IAM role, just as a matter of understanding and remembering, not how AWS wants us to think about it
so just like any other resource where we add a resource policy (if available) when you want to protect the resource, you do the same for iam role
👍 1723993f2024/11/25 - 正解だと思う選択肢: B
ChatGPT Explanation: The trust policy determines who can assume the IAM role. Adding an aws:MultiFactorAuthPresent condition to the trust policy ensures that only sessions authenticated with MFA can assume the role.
👍 1TareDHakim2025/01/02
シャッフルモード