Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 311 discussion

Exam question from Amazon's AWS Certified DevOps Engineer - Professional DOP-C02

Question #: 311
Topic #: 1

[All AWS Certified DevOps Engineer - Professional DOP-C02 Questions]

A company uses an AWS Cloud Development Kit (AWS CDK) application for its infrastructure. The AWS CDK application creates AWS Lambda functions and the IAM roles that are attached to the functions. The company also uses AWS Organizations. The company's developers can assume the AWS CDK application deployment role.

The company's security team discovered that the developers and the role used to deploy the AWS CDK application have more permissions than necessary. The security team also discovered that the roles attached to the Lambda functions that the CDK application creates have more permissions than necessary. The developers must not have the ability to grant additional permissions.

Which solution will meet these requirements with the LEAST operational overhead?

A. Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role and the AWS CDK application deployment role. Centrally create new IAM roles to attach to the Lambda functions for the developers to use to provision Lambda functions.
B. Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Update the account's AWS CDK bootstrapping to use the permission boundary. Update the configuration in the AWS CDK application for the default permissions boundary to use the policy.
C. Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Instruct the developers to use the permission boundary policy name when they create a role in the AWS CDK application code.
D. Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role. Give the AWS CDK deployment role access to create roles associated with Lambda functions. Run AWS Identity and Access Management Access Analyzer to verify that the Lambda functions role does not have permissions.

Show Suggested Answer

Suggested Answer: B 🗳️

by phu0298 at Nov. 27, 2024, 4:05 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Srikantha

2 months, 3 weeks ago

Selected Answer: B

Option B → Use a permission boundary at the AWS CDK bootstrap level to restrict both developer permissions and Lambda function roles. This solution enforces least privilege, requires no manual IAM role creation, and keeps the AWS CDK workflow seamless.

upvoted 1 times

...

teo2157

5 months ago

Selected Answer: A

Going for A as B doesn´t restrict any permission to the deverlopers, just to the CDK role...

upvoted 3 times

...

phu0298

6 months, 4 weeks ago

Selected Answer: B

In Option B, the use of a permission boundary directly in the CDK workflow ensures that the created roles are inherently compliant, removing the need for IAM Access Analyzer’s reactive validation step. This approach reduces operational complexity and aligns with best practices for proactive security.

upvoted 4 times

...