CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Automated Temporary Access Management in AWS
Explore an exam question on AWS IAM Roles for managing temporary access for contractors and understand the reasoning behind the answer.
You may find that many candidates struggle with decisions about access management in AWS. This question specifically tests your understanding of the best practices for granting temporary access while minimizing security risks.
The question
You need to implement an automated solution for managing temporary access to AWS resources for contractors. Which AWS service should you use to facilitate this while minimizing security risks?
A. AWS IAM Roles with temporary security credentials.
B. AWS IAM Users with limited permissions.
C. AWS Organizations with cross-account access.
D. AWS CloudTrail for tracking user activity.
Think before you scroll
Consider the primary purpose of each option. Focus on how each service handles access management and security. The goal is to ensure that contractors can access resources without creating unnecessary risks.
The answer
The correct option is A. AWS IAM Roles with temporary security credentials. IAM Roles allow you to provide contractors with temporary access to AWS resources without creating long-term user accounts. This minimizes security risks associated with permanent credentials.
Why the other options lose
B. AWS IAM Users with limited permissions. While IAM Users can be configured with limited permissions, they create permanent accounts. This approach increases management overhead and security risks associated with long-term credentials.
C. AWS Organizations with cross-account access. AWS Organizations helps manage multiple AWS accounts but does not directly provide a mechanism for temporary access. It's more about structuring accounts than managing individual access.
D. AWS CloudTrail for tracking user activity. CloudTrail is essential for monitoring and logging user activity but does not manage access. It is not a solution for granting access, which is the core requirement of the question.
The concept behind it
The principle of using IAM Roles for temporary access is critical in cloud security. Roles allow for the delegation of access without the need for creating permanent IAM Users. This reduces the attack surface and enhances security by limiting access duration.
Exam trap to remember
Remember: Always opt for temporary access solutions over permanent accounts when managing external access.