QuestionQ24
Security and ComplianceA company uses an AWS Cloud Development Kit (AWS CDK) application for its infrastructure. The AWS CDK application creates AWS Lambda functions and the IAM roles attached to those functions. The company also uses AWS Organizations. The company’s developers can assume the AWS CDK application deployment role.
The company’s security team discovered that the developers and the role used to deploy the AWS CDK application have more permissions than required. The security team also found that the roles attached to the Lambda functions created by the CDK application have more permissions than necessary. The developers must not be able to grant additional permissions.
Which solution meets these requirements with the LEAST operational overhead?
- A Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role and the AWS CDK application deployment role. Centrally create new IAM roles to attach to the Lambda functions for the developers to use to provision Lambda functions.
- B Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Update the account's AWS CDK bootstrapping to use the permission boundary. Update the configuration in the AWS CDK application for the default permissions boundary to use the policy.
- C Create an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Instruct the developers to use the permission boundary policy name when they create a role in the AWS CDK application code.
- D Create an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role. Give the AWS CDK deployment role access to create roles associated with Lambda functions. Run AWS Identity and Access Management Access Analyzer to verify that the Lambda functions role does not have permissions.
Community Discussion