Q82 — AWS SAA-C03 Ch.15

Question 82 of 100 | ← Chapter 15

Q1182. A multinational company operates in multiple AWS Regions. The company must ensure that its developers and administrators have secure,role-based access to AWS resources. The roles must be specific to each user's geographic location and job responsibilities.The company wants to implement a solution to ensure that each team can access only resources within the team's Region.The company wants to use its existing directory service to manage user access.The existing directory service organizes users into roles based on location. The system must be capable of integrating seamlessly with multi-factor authentication (MFA).Which solution will meet these requirements?

• A. Use AWS Security Token Service (AWS STS) to generate temporary access tokens to grant users access to the company's AWS account. Integrate AWS STS with the company's existing directory service to authenticate users. Assign Region specific roles based on predefined policies.
• B. Configure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the company's existing directory service to set up Region specific IAM roles for each user's account. ✓
• C. Create IAM managed policies that restrict access based on each user's geographic location. Apply IAM policies based on group memberships in the company's existing directory service.
• D. Use custom AWS Lambda functions to implement a dynamic IAM policy approach that adjusts permissions based on each user's current login location and job function. Integrate this approach with the existing directory service to verify user identities and to assign roles.

Correct Answer: B. Configure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the company's existing directory service to set up Region specific IAM roles for each user's account.

Explanation

To meet the requirements of providing secure, role-based access to AWS resources for developers and administrators across multiple AWS Regions, with roles specific to each user's geographic location and job responsibilities, while using the existing directory service and integrating with multi-factor authentication (MFA), the best solution is B. Configure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the company's existing directory service to set up Region-specific IAM roles for each user's account.Analysis of Options:Option A: Use AWS Security Token Service (AWS STS) to generate temporary access tokens to grant users access to the company's AWS account. Integrate AWS STS with the company's existing directory service to authenticate users. Assign Region-specific roles based on predefined policies. Limitation: While AWS STS can generate temporary credentials, managing and assigning Region-specific roles manually for each user based on their location and job responsibilities can be complex and error- prone. It also requires significant custom integration and maintenance. Option B: Configure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the company's existing directory service to set up Region-specific IAM roles for each user's account. Advantage: AWS IAM Identity Center (formerly AWS Single Sign-On) simplifies the management of user access to AWS accounts and applications. It supports federated access, allowing you to integrate with your existing directory service (e.g., Active Directory, LDAP). You can set up Region-specific IAM roles based on user attributes in the directory service, ensuring that each user has access only to the resources within their designated Region. IAM Identity Center also supports MFA, meeting the security requirement. Option C: Create IAM managed policies that restrict access based on each user's geographic location. Apply IAM policies based on group memberships in the company's existing directory service. Limitation: While IAM managed policies can restrict access, managing Region-specific access at the policy level for each user or group can become complex, especially as the number of users and Regions grows. It also requires careful planning and maintenance to ensure that policies are correctly applied and updated. Option D: Use custom AWS Lambda functions to implement a dynamic IAM policy approach that adjusts permissions based on each user's current login location and job function. Integrate this approach with the existing directory service to verify user identities and to assign roles. Limitation: This solution involves significant development effort to create and maintain custom Lambda functions. It also adds complexity to the system, as you need to ensure that the Lambda functions are secure, reliable, and scalable. Additionally, managing dynamic IAM policies can be error-prone and may not provide the same level of visibility and control as IAM Identity Center.Conclusion:B. Configure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the company's existing directory service to set up Region-specific IAM roles for each user's account. is the best solution to meet the requirements. It provides a centralized, scalable, and secure way to manage user access to AWS resources across multiple Regions, with roles tailored to each user's geographic location and job responsibilities. IAM Identity Center also integrates seamlessly with MFA, enhancing security.