Q97 — AWS SAA-C03 Ch.13

Question 97 of 100 | ← Chapter 13

Q997. A company needs to grant a team of developers access to the company's AWS resources. The company must maintain a high level of security for the resources.The company requires an access control solution that will prevent unauthorized access to the sensitive data.Which solution will meet these requirements?

• A. Share the IAM user credentials for each development team member with the rest of the team to simplify access management and to streamline development workflows.
• B. Define IAM roles that have fine-grained permissions based on the principle of least privilege. Assign an IAM role to each developer. ✓
• C. Create IAM access keys to grant programmatic access to AWS resources. Allow only developers to interact with AWS resources through API calls by using the access keys.
• D. Create an AWS Cognito user pool. Grant developers access to AWS resources by using the user pool.

Correct Answer: B. Define IAM roles that have fine-grained permissions based on the principle of least privilege. Assign an IAM role to each developer.

Explanation

To grant a team of developers access to the company's AWS resources while maintaining a high level of security and preventing unauthorized access to sensitive data, the best solution is:B. Define IAM roles that have fine-grained permissions based on the principle of least privilege. Assign an IAM role to each developer.Explanation:IAM Roles with Fine-Grained Permissions: By defining IAM roles that adhere to the principle of least privilege, you can ensure that each developer has only the permissions necessary to perform their job functions. This minimizes the risk of unauthorized access to sensitive data.Role Assignment: Assigning roles to developers allows for centralized management of permissions and easy updates if a developer's role changes or if new permissions are required. Roles can also be assumed by users or AWS services, enhancing security.Evaluation of Other Options:A. Share the IAM user credentials...: This option is highly insecure. Sharing IAM user credentials compromises security and auditing capabilities, making it difficult to track individual actions and enforce accountability.C. Create IAM access keys...: While this option allows programmatic access, it also introduces risks associated with key management, such as potential exposure or misuse of these keys. It's better to use IAM roles instead of access keys whenever possible.D. Create an AWS Cognito user pool...: While AWS Cognito can manage user authentication and authorization, it is more suited for applications needing user sign-up and sign-in functionalities. It does not provide the same level of fine-grained IAM permissions management as IAM roles.In summary, Option B is the most secure and effective solution for managing developer access to AWS resources while maintaining a high level of security and preventing unauthorized access to sensitive data.