Q66 — AWS SAA-C03 Ch.15

Question 66 of 100 | ← Chapter 15

Q1166. A company needs to provide a team of contractors with temporary access to the company's AWS resources for a short-term project. The contractors need different levels of access to AWS services.The company needs to revoke permissions for all the contractors when the project is finished.Which solution will meet these requirements with the LEAST operational overhead?

• A. Use AWS IAM to create a user account for each contractor. Attach policies that define access levels for the contractors to the user accounts. Manually deactivate the accounts when the project is finished.
• B. Use AWS Security Token Service (AWS STS) to generate temporary credentials for the contractors.Provide the contractors access based on predefined roles. Set the access to automatically expire when the project is finished. ✓
• C. Configure AWS Config rules to monitor the contractors' access patterns. Use AWS Config rules to automatically revoke permissions that are not in use or that are too permissive.
• D. Use AWS CloudTrail and custom Amazon EventBridge triggers to audit the contractors' actions. Adjust the permissions for each contractor based on activity logs.

Correct Answer: B. Use AWS Security Token Service (AWS STS) to generate temporary credentials for the contractors.Provide the contractors access based on predefined roles. Set the access to automatically expire when the project is finished.

Explanation

To meet the company's requirements of providing temporary access to AWS resources with different permission levels and revoking access automatically with the least operational overhead, the best solutionis:Correct Answer:BB. Use AWS Security Token Service (AWS STS) to generate temporary credentials for the contractors. Provide the contractors access based on predefined roles. Set the access to automatically expire when the project is finished.Explanation:AWS Security Token Service (AWS STS):Allows generating temporary security credentials (access key ID, secret access key, and session token) that expire after a specified duration.Credentials are associated with IAM roles, which define the permissions for the contractors. Ideal for granting temporary access without creating permanent IAM users.Predefined Roles with Different Permission Levels:You can create multiple IAM roles with different permission policies (e.g., Contractor-ReadOnly, Contractor- Admin).Contractors assume these roles to get temporary credentials with the appropriate permissions.Automatic Expiration:Temporary credentials generated by STS expire after a configurable time (e.g., 1 hour, 12 hours, or 1 day). No manual intervention is needed to revoke access--it happens automatically when the credentials expire.Least Operational Overhead:No need to create, manage, or deactivate individual IAM user accounts. No need for manual permission adjustments or auditing (though monitoring is still recommended).Why Other Options Are Incorrect:A. Use AWS IAM to create a user account for each contractor. Attach policies that define access levels for the contractors to the user accounts. Manually deactivate the accounts when the project is finished. This requires manual deactivation of accounts, increasing operational overhead. Creating and managing individual IAM users is tedious and not scalable for temporary access. C. Configure AWS Config rules to monitor the contractors' access patterns. Use AWS Config rules to automatically revoke permissions that are not in use or that are too permissive. AWS Config is for monitoring and compliance, not for managing temporary access. It cannot automatically revoke permissions or generate temporary credentials. D. Use AWS CloudTrail and custom Amazon EventBridge triggers to audit the contractors' actions. Adjust the permissions for each contractor based on activity logs. CloudTrail and EventBridge are for auditing and logging, not for managing temporary access. Adjusting permissions based on logs is reactive and requires manual intervention, increasing operational overhead.Key Takeaways:AWS STS is the best choice for temporary, role-based access with automatic expiration. IAM roles allow defining different permission levels without creating permanent users. Other options (IAM users, AWS Config, CloudTrail) are not designed for temporary access management.Final Answer:B. Use AWS Security Token Service (AWS STS) to generate temporary credentials for the contractors. Provide the contractors access based on predefined roles. Set the access to automatically expire when the project is finished.