Question
An ecommerce company has chosen AWS to host its new platform. The company's DevOps team has started building an AWS Control Tower landing zone. The DevOps team has set the identity store within AWS IAM Identity Center (AWS Single Sign-On) to external identity provider (IdP) and has configured SAML 2.0.
The DevOps team wants a robust permission model that applies the principle of least privilege. The model must allow the team to build and manage only the team's own resources.
Which combination of steps will meet these requirements? (Choose three.)
- A. Create IAM policies that include the required permissions. Include the aws:PrincipalTag condition key.
- B. Create permission sets. Attach an inline policy that includes the required permissions and uses the aws:PrincipalTag condition key to scope the permissions. Correct
- C. Create a group in the IdP. Place users in the group. Assign the group to accounts and the permission sets in IAM Identity Center. Correct
- D. Create a group in the IdP. Place users in the group. Assign the group to OUs and IAM policies.
- E. Enable attributes for access control in IAM Identity Center. Apply tags to users. Map the tags as key-value pairs.
- F. Enable attributes for access control in IAM Identity Center. Map attributes from the IdP as key-value pairs. Correct
Explanation
Option B is correct because creating permission sets and attaching inline policies with aws:PrincipalTag condition keys ensures that permissions are scoped appropriately according to the principle of least privilege. Option C is correct as it involves creating a group in the IdP, placing users into this group, and assigning them to accounts and permission sets within IAM Identity Center, which helps manage access effectively. Option F is correct because enabling attributes for access control in IAM Identity Center and mapping attributes from the IdP as key-value pairs allows for fine-grained access management based on user attributes.
