AWS Certified Security – Specialty — Question 222

A company's development team is designing an application using AWS Lambda and Amazon Elastic Container Service (Amazon ECS). The development team needs to create IAM roles to support these systems. The company's security team wants to allow the developers to build IAM roles directly, but the security team wants to retain control over the permissions the developers can delegate to those roles. The development team needs access to more permissions than those required for application's AWS services. The solution must minimize management overhead.
How should the security team prevent privilege escalation for both teams?

Answer options

• A. Enable AWS CloudTrail. Create a Lambda function that monitors the event history for privilege escalation events and notifies the security team.
• B. Create a managed IAM policy for the permissions required. Reference the IAM policy as a permissions boundary within the development team's IAM role.
• C. Enable AWS Organizations. Create an SCP that allows the iam:CreateUser action but that has a condition that prevents API calls other than those required by the development team.
• D. Create an IAM policy with a deny on the iam:CreateUser action and assign the policy to the development team. Use a ticket system to allow the developers to request new IAM roles for their applications. The IAM roles will then be created by the security team.

Correct answer: B

Explanation

The correct answer is B because using a permissions boundary allows the security team to define the maximum permissions that the development team can delegate, thus preventing privilege escalation. Option A does not prevent privilege escalation proactively but rather monitors it, while option C does not provide sufficient control over the permissions. Option D introduces unnecessary overhead by requiring a ticketing system, which complicates the process for developers.