SCS-C02 · Question #239
A company is running workloads on AWS. The workloads are in separate AWS accounts for development, testing, and production. All the company's developers can access the development account. A subset…
The correct answer is C. Create IAM roles in the testing account and production account. Add a policy that allows the. Using IAM roles with cross-account access and the sts:AssumeRole action is a scalable and secure solution that allows developers to access resources across multiple accounts without sharing long-term credentials. This approach allows developers in the development account to…
Question
A company is running workloads on AWS. The workloads are in separate AWS accounts for development, testing, and production. All the company's developers can access the development account. A subset of the developers can access the testing account and the production account. The company is spending too much time managing individual credentials for every developer across every environment. A security engineer must implement a more scalable solution that the company can use when a developer needs different access. The solution must allow developers to access resources across multiple accounts. The solution also must minimize credential sharing. Which solution will meet these requirements?
Options
- AUse AWS Identity and Access Management Access Analyzer to identity the permissions that the
- BCreate an Amazon Simple Workflow Service (Amazon SWF) workflow. Instruct the developers to
- CCreate IAM roles in the testing account and production account. Add a policy that allows the
- DCreate service accounts in the testing environment and production environment. Give the access
How the community answered
(34 responses)- A3% (1)
- B9% (3)
- C74% (25)
- D15% (5)
Explanation
Using IAM roles with cross-account access and the sts:AssumeRole action is a scalable and secure solution that allows developers to access resources across multiple accounts without sharing long-term credentials. This approach allows developers in the development account to assume roles in the testing and production accounts as needed, based on permissions defined in the trust policy. It minimizes credential management complexity and avoids credential sharing, as developers use temporary session-based credentials through role assumption.
Topics
Community Discussion
No community discussion yet for this question.