Q40 — AWS SAA-C03 Ch.14

Question 40 of 100 | ← Chapter 14

Q1040. A company is building a cloud-based application on AWS that will handle sensitive customer data. The application uses Amazon RDS for the database, Amazon S3 for object storage, and S3 Event Notifications that invoke AWS Lambda for serverless processing.The company uses AWS IAM Identity Center to manage user credentials. The development, testing, and operations teams need secure access to Amazon RDS and Amazon S3 while ensuring the confidentiality of sensitive customer data. The solution must comply with the principle of least privilege.Which solution meets these requirements with the LEAST operational overhead?

• A. Use IAM roles with least privilege to grant all the teams access. Assign IAM roles to each team with customized IAM policies defining specific permission for Amazon RDS and S3 object access based on team responsibilities.
• B. Enable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets. ✓
• C. Create individual IAM users for each member in all the teams with role-based permissions. Assign the IAM roles with predefined policies for RDS and S3 access to each user based on user needs.Implement IAM Access Analyzer for periodic credential evaluation.
• D. Use AWS Organizations to create separate accounts for each team. Implement cross-account IAM roles with least privilege. Grant specific permission for RDS and S3 access based on team roles and responsibilities.

Correct Answer: B. Enable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets.

Explanation

To meet the requirements of providing secure access to Amazon RDS and Amazon S3 while ensuring the confidentiality of sensitive customer data and complying with the principle of least privilege, the best solution is:B. Enable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets.Explanation:\1. AWS IAM Identity Center: - IAM Identity Center simplifies the management of user identities and access permissions across AWS accounts. It provides a centralized way to manage user access without the need to create and manage individual IAM users or roles manually.\2. Granular Access Control: - By creating permission sets, you can define specific access levels for Amazon RDS and S3 tailored to the needs of each team. This ensures that each team has only the permissions necessary to perform their tasks, adhering to the principle of least privilege.\3. Operational Overhead: - Using IAM Identity Center reduces operational overhead significantly compared to managing individual IAM users or roles. It automates user provisioning and deprovisioning and simplifies access management, making it easier to maintain security and compliance.Evaluation of Other Options:A. Use IAM roles with least privilege to grant all the teams access: - While this approach can work, it requires more manual management of roles and policies. It may become complex as the number of teams grows, leading to higher operational overhead.C. Create individual IAM users for each member in all the teams with role-based permissions: - This approach introduces significant management overhead, especially in terms of user lifecycle management (onboarding and offboarding). It also increases the risk of misconfiguration and does not leverage centralized access management.D. Use AWS Organizations to create separate accounts for each team: - While this provides strong isolation, it adds complexity and overhead in managing multiple accounts. This solution may not be necessary for the use case described and could lead to additional administrative burdens.Conclusion:Option B is the most efficient and effective solution for managing access to sensitive data in AWS while minimizing operational overhead and maintaining security through the principle of least privilege.