DOP-C02 · Question #59
A company has multiple AWS accounts. The company uses AWS IAM Identity Center (AWS Single Sign-On) that is integrated with AWS Toolkit for Microsoft Azure DevOps. The attributes for access control…
The correct answer is C. Condition": { "StringEquals": { "ec2:ResourceTag/department": "${aws:PrincipalTag/department}" } }. Option C is correct because it uses the EC2-specific resource tag condition key ec2:ResourceTag/department to compare against the principal's session tag ${aws:PrincipalTag/department}, which is dynamically populated from the Azure AD attribute mapped in IAM Identity Center…
Question
A company has multiple AWS accounts. The company uses AWS IAM Identity Center (AWS Single Sign-On) that is integrated with AWS Toolkit for Microsoft Azure DevOps. The attributes for access control feature is enabled in IAM Identity Center. The attribute mapping list contains two entries. The department key is mapped to ${path:enterprise.department}. The costCenter key is mapped to ${path:enterprise.costCenter}. All existing Amazon EC2 instances have a department tag that corresponds to three company departments (d1, d2, d3). A DevOps engineer must create policies based on the matching attributes. The policies must minimize administrative effort and must grant each Azure AD user access to only the EC2 instances that are tagged with the user's respective department name. Which condition key should the DevOps engineer include in the custom permissions policies to meet these requirements? A. B. C. D.
Exhibit
Options
- ACondition": { "ForAllValues:StringEquals": { "aws:TagKeys": ["department"] } }
- BCondition": { "StringEquals": { "aws:PrincipalTag/department": "${aws:ResourceTag/department}" } }
- CCondition": { "StringEquals": { "ec2:ResourceTag/department": "${aws:PrincipalTag/department}" } }
- DCondition": { "ForAllValues:StringEquals": { "ec2:ResourceTag/department": ["d1", "d2", "d3"] } }
How the community answered
(19 responses)- A5% (1)
- B21% (4)
- C63% (12)
- D11% (2)
Explanation
Option C is correct because it uses the EC2-specific resource tag condition key ec2:ResourceTag/department to compare against the principal's session tag ${aws:PrincipalTag/department}, which is dynamically populated from the Azure AD attribute mapped in IAM Identity Center. This approach creates a single policy that automatically grants each user access only to EC2 instances tagged with their own department, requiring no manual updates as users or departments change - minimizing administrative effort.
Topics
Community Discussion
No community discussion yet for this question.