Developers create temporary ETL roles.
They must not create a role with administrator-level authority.
Which authorization approach is most appropriate?
Require a permissions boundary as the maximum authority for developer-created roles and combine it with SCPs where needed.
Detailed explanation
Names are not evaluated during policy authorization.
Names are not evaluated during policy authorization.
They could create and attach arbitrary permissions.
They could create and attach arbitrary permissions.
Post-incident audit does not prevent an operation.
Post-incident audit does not prevent an operation.
A broad identity policy cannot grant effective permissions outside the boundary.
A broad identity policy cannot grant effective permissions outside the boundary.
Check official documentation
Compare the following points with the official documentation.
AWS IAM permissions boundaries、policy evaluation logic、SCPの公式説明を確認する。
What to confirm
ロール名・事後監査と、権限境界による予防制御の違いを説明できる。
Key points
- Permissions boundary
- Maximum permission
- SCP
- Delegated administration
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Policy evaluation
An identity Allow is effective only when boundary and organization constraints also allow it.
Separation
Protect the boundary itself from the delegated creator.