A development team creates IAM roles for its workloads.
A central administrator must limit the maximum permissions the team can grant.
Which method is most appropriate?
Attach an IAM permissions boundary to the roles so delegated administrators cannot grant permissions beyond the centrally defined maximum.
Detailed explanation
Policy visibility does not enforce an authorization boundary and can expose security information.
Policy visibility does not enforce an authorization boundary and can expose security information.
Versioning supports object recovery and has no effect on IAM permission limits.
Versioning supports object recovery and has no effect on IAM permission limits.
A permissions boundary limits the maximum permissions that the role can receive even when another policy grants more actions.
A permissions boundary limits the maximum permissions that the role can receive even when another policy grants more actions.
Broad administrator access removes the intended maximum-permission restriction.
Broad administrator access removes the intended maximum-permission restriction.
Check official documentation
Compare the following points with the official documentation.
IAM permissions boundaryの公式説明を確認する。
What to confirm
付与権限と最大権限境界を分けて設計できる。
Key points
- Permissions boundary
- Maximum permissions
- Delegated administration
Notes
- Environment: AWS公式IAMドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Delegation with limits
A permissions boundary lets a team create or manage roles without allowing privilege escalation beyond the central limit.
Policy intersection
Effective permissions require both an identity policy and the boundary to allow the action.