SCS-C02 · Question #208
A company has two AWS accounts: Account A and Account B. Account A has an IAM role that IAM users in Account B assume when they need to upload sensitive documents to Amazon S3 buckets in Account A…
The correct answer is B. Add an aws:MultiFactorAuthPresent condition to the role's trust policy. To ensure that IAM users in Account B can only assume a role in Account A if they are authenticated with Multi-Factor Authentication (MFA), the recommended solution is to add an aws:MultiFactorAuthPresent condition to the role's trust policy in Account A. The trust policy…
Question
A company has two AWS accounts: Account A and Account B. Account A has an IAM role that IAM users in Account B assume when they need to upload sensitive documents to Amazon S3 buckets in Account A. A new requirement mandates that users can assume the role only if they are authenticated with multi-factor authentication (MFA). A security engineer must recommend a solution that meets this requirement with minimum risk and effort. Which solution should the security engineer recommend?
Options
- AAdd an aws:MultiFactorAuthPresent condition to the role's permissions policy.
- BAdd an aws:MultiFactorAuthPresent condition to the role's trust policy.
- CAdd an aws:MultiFactorAuthPresent condition to the session policy.
- DAdd an aws:MultiFactorAuthPresent condition to the S3 bucket policies.
How the community answered
(42 responses)- A2% (1)
- B83% (35)
- C5% (2)
- D10% (4)
Explanation
To ensure that IAM users in Account B can only assume a role in Account A if they are authenticated with Multi-Factor Authentication (MFA), the recommended solution is to add an aws:MultiFactorAuthPresent condition to the role's trust policy in Account A. The trust policy defines which principals (users, applications, services) can assume the role and under what conditions. By adding the aws:MultiFactorAuthPresent condition, the policy explicitly requires MFA to be present for the assume role action to succeed. This ensures that only authenticated users with MFA can assume the role, enhancing the security posture with minimal operational overhead and without modifying permissions or session policies, which could affect the role's intended capabilities.
Topics
Community Discussion
No community discussion yet for this question.