A company is building a cloud-based application on AWS that will handle sensitive customer data. The application uses Amazon RDS for the database. Amazon S3 for object storage, and S3 Event…

Question

Options

• AUse IAM roles with least privilege to grant all the teams access. Assign IAM roles to each team
• BEnable IAM Identity Center with an Identity Center directory. Create and configure permission
• CCreate individual IAM users for each member in all the teams with role-based permissions.
• DUse AWS Organizations to create separate accounts for each team. Implement cross-account

• A
  9% (4)
• B
  77% (34)
• C
  11% (5)
• D
  2% (1)

Explanation

This solution allows for secure and least-privilege access with minimal operational overhead. IAM Identity Center: AWS IAM Identity Center (formerly AWS SSO) enables you to centrally manage access to multiple AWS accounts and applications. By using IAM Identity Center, you can assign permission sets that define what users or groups can access, ensuring that only necessary permissions are granted. Permission Sets: Permission sets in IAM Identity Center allow you to define granular access controls for specific services, such as Amazon RDS and S3. You can tailor these permissions to meet the needs of different teams, adhering to the principle of least privilege. Group Management: By assigning users to groups and associating those groups with specific permission sets, you reduce the complexity and overhead of managing individual IAM roles and policies. This method also simplifies compliance and audit processes. Why Not Other Options? Option A (IAM roles): While IAM roles can provide least-privilege access, managing multiple roles and policies across teams increases operational overhead compared to using IAM Identity Option C (Individual IAM users): Managing individual IAM users and roles can be cumbersome and does not scale well compared to group-based management in IAM Identity Center. Option D (AWS Organizations with cross-account roles): Creating separate accounts and cross- account roles adds unnecessary complexity and overhead for this use case, where IAM Identity Center provides a more straightforward solution.

No community discussion yet for this question.