SAP-C02 · Question #126
A company has deployed an application to multiple environments in AWS, including production and testing. The company has separate accounts for production and testing, and users are allowed to create…
The correct answer is A. Create a new AWS account to hold user and service accounts, such as an identity account. A: By centralizing users to a single account, a user can access the prod and test using assume role. This ensures that all actions are properly logged and is the most secure. Adapted from this…
Question
A company has deployed an application to multiple environments in AWS, including production and testing. The company has separate accounts for production and testing, and users are allowed to create additional application users for team members or services, as needed. The Security team has asked the Operations team for better isolation between production and testing with centralized controls on security credentials and improved management of permissions between environments. Which of the following options would MOST securely accomplish this goal?
Options
- ACreate a new AWS account to hold user and service accounts, such as an identity account.
- BModify permissions in the production and testing accounts to limit creating new IAM users to
- CCreate a script that runs on each account that checks user accounts for adherence to a security
- DCreate all user accounts in the production account.
How the community answered
(53 responses)- A79% (42)
- B8% (4)
- C2% (1)
- D11% (6)
Explanation
A: By centralizing users to a single account, a user can access the prod and test using assume role. This ensures that all actions are properly logged and is the most secure. Adapted from this https://aws.amazon.com/blogs/security/how-to-centralize-and-automate-iam-policy-creation-in- sandbox-development-and-test-environments/ B: This means the test users will still need to be created. The problem with test users is always security. Who is the actual person behind the scene carrying out that specific actions? This is unlikely the most secure option. C: Any answers that is asking you to write a script is very unlikely to be the answer. D: This seems to be able to work too which is similar to A. But the Security team already asked for "better isolation with centralized controls".
Community Discussion
No community discussion yet for this question.