AWS Certified DevOps Engineer – Professional — Question 157

An ecommerce company has chosen AWS to host its new platform. The company's DevOps team has started building an AWS Control Tower landing zone. The DevOps team has set the identity store within AWS Single Sign-On (AWS SSO) to external identity provider (IdP) and has configured SAML 2 0.

The DevOps team wants a robust permission model that applies the principle of least privilege. The model must allow the team to build and manage only the team's own resources.

Which combination of steps will meet these requirements? (Choose three.)

Answer options

• A. Create IAM policies that include the required permissions. Include the aws PrincipalTag condition key.
• B. Create permission sets. Attach an inline policy that includes the required permissions and uses the aws:PrincipalTag condition key to scope the permissions.
• C. Create a group in the IdP. Place users in the group. Assign the group to accounts and the permission sets in AWS SSO.
• D. Create a group in the IdP. Place users in the group. Assign the group to OUs and IAM policies.
• E. Enable attributes for access control in AWS SSO. Apply tags to users. Map the tags as key-value pairs.
• F. Enable attributes for access control in AWS SSO. Map attributes from the IdP as key-value pairs.

Correct answer: B, C, F

Explanation

The correct answer is B, C, and F because they collectively ensure a least privilege model by defining specific permissions through permission sets and mapping IdP attributes effectively. Option A is incorrect as it focuses solely on IAM policies without the integration of AWS SSO. Option D is not suitable because it assigns permissions at the organizational unit (OU) level rather than specifically to permission sets in AWS SSO. Option E does not address the necessary permission structuring needed for the DevOps team.