QuestionQ144
Data Security and GovernanceA company with global operations must comply with regulations requiring data from an AWS Region to be accessible only within that same Region.
A data engineer is building a data pipeline that will create resources in the Region in which the data engineer works. The data pipeline must access data only in the Region where the data engineer works. The pipeline uses Active Directory for identity and authentication. It uses a custom identity broker application to confirm that employees are signed in to Active Directory and to obtain temporary credentials by using the AssumeRole API operation.
Which solution meets the locality requirements with the LEAST administrative effort?
- A Create an IAM role that has permissions to create resources. Create a policy for each Region that ensures users can create resources only in that Region. Pass the policy as the session policy when employees obtain the temporary credentials.
- B Create an IAM role for data engineers in each Region separately. Instruct each data engineer to obtain temporary credentials by assuming the appropriate Region specific IAM role.
- C Create an IAM group for each Region. Include the required IAM policies for each IAM group. Add users to each IAM group so that when users log in by obtaining the temporary credentials, the users will receive the appropriate access based on the IAM group.
- D Create individual IAM policies that allow users to create resources in a specific Region. Assign the policies to each data engineer. Allow users to assume the individually assigned role when the users log in to AWS.
Community Discussion