SCS-C02 · Question #440
A company has an organization in AWS Organizations that includes dedicated accounts for each of its business units. The company is collecting all AWS CloudTrail logs from the accounts in a single…
The correct answer is A. Attach a policy to the IAM user to allow the user to assume the role that was created in the top-. In AWS, cross-account access is typically achieved through IAM roles. The security engineer has already created roles in the top-level account, and each role has the necessary permissions for read-only access to the respective CloudTrail logs in the S3 bucket. To allow the IAM…
Question
A company has an organization in AWS Organizations that includes dedicated accounts for each of its business units. The company is collecting all AWS CloudTrail logs from the accounts in a single Amazon S3 bucket in the top-level account. The company's IT governance team has access to the top-level account. A security engineer needs to allow each business unit to access its own CloudTrail logs. The security engineer creates an IAM role in the top-level account for each of the other accounts. For each role, the security engineer creates an IAM policy to allow read-only permissions to objects in the S3 bucket with the prefix of the respective logs. Which action must the security engineer take in each business unit account to allow an IAM user in that account to read the logs?
Options
- AAttach a policy to the IAM user to allow the user to assume the role that was created in the top-
- BCreate an SCP that grants permissions to the top-level account.
- CUse the root account of the business unit account to assume the role that was created in the top-
- DForward the credentials of the IAM role in the top-level account to the IAM user in the business
How the community answered
(56 responses)- A79% (44)
- B5% (3)
- C13% (7)
- D4% (2)
Explanation
In AWS, cross-account access is typically achieved through IAM roles. The security engineer has already created roles in the top-level account, and each role has the necessary permissions for read-only access to the respective CloudTrail logs in the S3 bucket. To allow the IAM user in each business unit account to access the logs, the IAM user needs permission to assume the specific role created for its account in the top-level account. By attaching a policy to the IAM user that allows it to assume this role, and specifying the role's Amazon Resource Name (ARN) in the policy, the user can securely assume the role and gain access to the designated S3 bucket objects. This is a best practice in AWS for cross-account access, ensuring security while providing necessary permissions.
Topics
Community Discussion
No community discussion yet for this question.