DOP-C02 · Question #497
A company wants to improve its security practices by enforcing least privilege across all projects. Developers must be able to access Amazon EC2 resources but not Amazon RDS resources. Database…
The correct answer is A. For each project, create one IAM role for developers and one IAM role for database B. Modify the pre-existing IAM policies to include a StringEquals ResourceTag condition for projects C. Create an IAM policy that allows users to assume a role when the ResourceTag value matches. Create per-project roles for each job function and tag those roles with the correct project and job function so access decisions can be driven by tags and enforced consistently through role Update the existing job-function policies to use tag-based access control by requiring…
Question
A company wants to improve its security practices by enforcing least privilege across all projects. Developers must be able to access Amazon EC2 resources but not Amazon RDS resources. Database administrators must have access only to Amazon RDS resources. Every employee has a unique IAM user. There are already pre-existing IAM policies for developer and database administrator job functions. All AWS resources are already tagged with appropriate project tags. All the IAM users are tagged with the appropriate project and job function. The company must ensure that each employee can access only the project that the employee is working on. Which solution will meet these requirements? (Choose three.)
Options
- AFor each project, create one IAM role for developers and one IAM role for database
- BModify the pre-existing IAM policies to include a StringEquals ResourceTag condition for projects
- CCreate an IAM policy that allows users to assume a role when the ResourceTag value matches
- DCreate an IAM policy that allows users to assume a role when the ResourceTag value matches
- ETag the pre-existing IAM policies with the appropriate projects and job functions. Attach the
- FFor each project, create one IAM group for developers and one IAM group for database
How the community answered
(22 responses)- A68% (15)
- D5% (1)
- E9% (2)
- F18% (4)
Explanation
Create per-project roles for each job function and tag those roles with the correct project and job function so access decisions can be driven by tags and enforced consistently through role Update the existing job-function policies to use tag-based access control by requiring the target resources’ project tags to match the caller’s principal project tag, ensuring users can access only resources in their assigned project while still limiting actions to the correct service set for their job Attach a role-assumption policy to all users that permits assuming only the roles whose tags match the users’ own project and job-function principal tags, ensuring each employee can assume only the correct project-scoped role for their job.
Topics
Community Discussion
No community discussion yet for this question.