Topic 1 Question 236
A company uses AWS Organizations to manage a small number of AWS accounts. However, the company plans to add 1,000 more accounts soon. The company allows only a centralized security team to create IAM roles for all AWS accounts and teams. Application teams submit requests for IAM roles to the security team. The security team has a backlog of IAM role requests and cannot review and provision the IAM roles quickly.
The security team must create a process that will allow application teams to provision their own IAM roles. The process must also limit the scope of IAM roles and prevent privilege escalation.
Which solution will meet these requirements with the LEAST operational overhead?
Create an IAM group for each application team. Associate policies with each IAM group. Provision IAM users for each application team member. Add the new IAM users to the appropriate IAM group by using role-based access control (RBAC).
Delegate application team leads to provision IAM roles for each team. Conduct a quarterly review of the IAM roles the team leads have provisioned. Ensure that the application team leads have the appropriate training to review IAM roles.
Put each AWS account in its own OU. Add an SCP to each OU to grant access to only the AWS services that the teams plan to use. Include conditions in the AWS account of each team.
Create an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that only roles that have the permissions boundary attached can create any new IAM roles.
ユーザの投票
コメント(2)
- 正解だと思う選択肢: D
D. Create an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that only roles that have the permissions boundary attached can create any new IAM roles.
Service Control Policies (SCPs) and permissions boundaries are effective tools for controlling the maximum permissions an IAM role can have within an AWS Organization. By attaching an SCP to the root organizational unit (OU), you ensure that only roles with the permissions boundary can be created, which enforces strict controls on what these roles can do. This approach allows application teams to create roles within the defined boundaries, reducing the security team's workload and preventing privilege escalation.
👍 1IPLogic2024/12/05 - 正解だと思う選択肢: D
The correct answer is D
The company is rapidly scaling to 1,000+ AWS accounts and needs to delegate IAM role creation while ensuring security and preventing privilege escalation. The best approach is to use:
Service Control Policies (SCPs): These apply at the organizational level in AWS Organizations to enforce security rules across all accounts. Permissions Boundaries: These ensure that even if teams create IAM roles, they cannot grant excessive permissions beyond what the security team allows. This solution meets the requirements with the least operational overhead because: ✅ Application teams can create IAM roles themselves, reducing the security team's backlog. ✅ SCPs prevent teams from overriding security policies or creating overly permissive roles. ✅ Permissions boundaries ensure IAM roles have restricted permissions, preventing privilege escalation.
👍 1AWSLoverLoverLoverLoverLover2025/02/20
シャッフルモード