Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 385 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional SAP-C02

Question #: 385
Topic #: 1

[All AWS Certified Solutions Architect - Professional SAP-C02 Questions]

A company is running multiple workloads in the AWS Cloud. The company has separate units for software development. The company uses AWS Organizations and federation with SAML to give permissions to developers to manage resources in their AWS accounts. The development units each deploy their production workloads into a common production account.

Recently, an incident occurred in the production account in which members of a development unit terminated an EC2 instance that belonged to a different development unit. A solutions architect must create a solution that prevents a similar incident from happening in the future. The solution also must allow developers the possibility to manage the instances used for their workloads.

Which strategy will meet these requirements?

A. Create separate OUs in AWS Organizations for each development unit. Assign the created OUs to the company AWS accounts. Create separate SCP with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag that matches the development unit name. Assign the SCP to the corresponding OU.
B. Pass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation. Update the IAM policy for the developers’ assumed IAM role with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit.
C. Pass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation. Create an SCP with an allow action and a StringEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit. Assign the SCP to the root OU.
D. Create separate IAM policies for each development unit. For every IAM policy, add an allow action and a StringEquals condition for the DevelopmentUnit resource tag and the development unit name. During SAML federation, use AWS Security Token Service (AWS STS) to assign the IAM policy and match the development unit name to the assumed IAM role.

Show Suggested Answer

Suggested Answer: B 🗳️

by devalenzuela86 at Nov. 22, 2023, 6:31 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

vibzr2023

Highly Voted 1 year, 5 months ago

Answer: B Option A: While OUs and SCPs can provide access control, they are more suitable for broader permission boundaries and might not offer the same granularity as STS session tags and IAM policies.

upvoted 6 times

...

AzureDP900

Most Recent 7 months, 2 weeks ago

B is right The goal is to prevent developers from managing resources in another development unit's account, but still allow them to manage their own instances. By passing an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation, you can filter the IAM policies assigned to the developers' assumed IAM roles based on their own development unit name. Updating the IAM policy with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit ensures that developers cannot manage resources in another development unit's account. This approach also allows developers to manage their own instances, as long as they are not trying to access resources from another development unit.

upvoted 1 times

...

career360guru

1 year, 5 months ago

Selected Answer: B

Option A will not work for common Production Account.

upvoted 4 times

...

shaaam80

1 year, 6 months ago

Selected Answer: B

Answer B. A won't work as developer units needs to deploy resources in the common Production account

upvoted 3 times

...

J0n102

1 year, 6 months ago

Selected Answer: B

Answer: B

upvoted 2 times

...

siasiasia

1 year, 6 months ago

Selected Answer: B

A won't work for the common account which everybody needs access to. B is the way to go.

upvoted 2 times

...

heatblur

1 year, 7 months ago

Selected Answer: B

B is the best answer. This approach involves tagging federated identity sessions with a DevelopmentUnit attribute and then using IAM policies to deny actions if the DevelopmentUnit tag of the resource does not match the aws:PrincipalTag/DevelopmentUnit. This method directly ties permissions to the federated identity, allowing for finer-grained access control that aligns with your requirements.

upvoted 4 times

...