A solutions architect must provide a secure way for a team of cloud engineers to use the AWS CLI to upload objects into an Amazon S3 bucket Each cloud engineer has an IAM user. IAM access keys and a…

Question

Options

• AAttach a policy to the S3 bucket to prompt the IAM user for an MFA code when the IAM user
• BUpdate the trust policy for the S3-access group to require principals to use MFA when principals
• CAttach a policy to the S3-access group to deny all S3 actions unless MFA is present. Use IAM
• DAttach a policy to the S3-access group to deny all S3 actions unless MFA is present. Request

• A
  6% (2)
• B
  25% (9)
• C
  11% (4)
• D
  58% (21)

Explanation

This option meets the requirement by attaching a policy to the S3-access group to deny all S3 actions unless MFA is present. This ensures that the cloud engineers must use their MFA device when performing any actions in Amazon S3. Additionally, it also requests temporary credentials from AWS STS, which are short-lived credentials that are generated on-demand, and attaches them in a profile that Amazon S3 will reference when the user performs actions in Amazon S3, this will provide an extra layer of security and protection against any misuse of the access keys. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html You could use AWS CLI with the temporary credentials to call Amazon S3 and perform the necessary actions. https://aws.amazon.com/cli/

No community discussion yet for this question.