DOP-C02 · Question #1
A company has multiple member accounts that are part of an organization in AWS Organizations. The security team needs to review every Amazon EC2 security group and their inbound and outbound rules…
The correct answer is B. Create a trust relationship that allows users in the management account to assume the IAM roles C. Create an IAM role in each member account that has access to the AmazonEC2ReadOnlyAccess E. Create an I AM role in the management account that allows the sts:AssumeRole action against. (B) The trust relationship enables an IAM entity (user, group, or role) to assume a role. In this case, the entities in the management account need to assume roles in the member accounts. (C) The IAM role in each member account should have a policy attached that grants…
Question
A company has multiple member accounts that are part of an organization in AWS Organizations. The security team needs to review every Amazon EC2 security group and their inbound and outbound rules. The security team wants to programmatically retrieve this information from the member accounts using an AWS Lambda function in the management account of the organization. Which combination of access changes will meet these requirements? (Choose three.)
Options
- ACreate a trust relationship that allows users in the member accounts to assume the management
- BCreate a trust relationship that allows users in the management account to assume the IAM roles
- CCreate an IAM role in each member account that has access to the AmazonEC2ReadOnlyAccess
- DCreate an I AM role in each member account to allow the sts:AssumeRole action against the
- ECreate an I AM role in the management account that allows the sts:AssumeRole action against
- FCreate an IAM role in the management account that has access to the
How the community answered
(40 responses)- A23% (9)
- B60% (24)
- D5% (2)
- F13% (5)
Explanation
(B) The trust relationship enables an IAM entity (user, group, or role) to assume a role. In this case, the entities in the management account need to assume roles in the member accounts. (C) The IAM role in each member account should have a policy attached that grants read-only access to EC2 instances. The AmazonEC2ReadOnlyAccess managed policy provides this (E) An IAM role in the management account should be created that has the permission to perform the sts:AssumeRole action against the member account IAM role's ARN. This allows entities assuming this role to switch to the roles in the member accounts and perform actions according to the permissions of those roles.
Topics
Community Discussion
No community discussion yet for this question.