DOP-C02 practice question: Least privilege, permissions boundaries and ABAC (2 of 3)

Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

An online retailer's CI system assumes a deployment role in the shared-services account. The role's policy is broad, because one of the release jobs needs to manage several buckets, but a single release job should only write to the bucket of its own release.

The security team wants each job's session to be restricted to the one bucket it needs at the moment it runs, without creating a new IAM role for every release. The job runs several times a day, so the access must be granted each time it starts.

Which approach meets these requirements?

Choose one answer.

A. Create a new IAM role for each release that has a policy for that release's bucket only, and have the CI system assume that role for the job.
B. Pass a session policy with the AssumeRole call that limits the session to write access on the release's bucket.
C. Add a permissions boundary to the deployment role that limits it to the release bucket, so that each job that assumes the role can only write to that bucket.
D. Attach a resource-based bucket policy that grants write access only to the job's session name, and let the job set its session name to the release identifier.

Show the answer and explanation

Answer: B

A. Wrong: This meets the access rule, but it creates and deletes a role for every release. The security team wanted to avoid that upkeep.
B. Right: Correct. A session policy passed with AssumeRole narrows the permissions of that one session without changing the role. The effective permissions are the intersection of the role policy and the session policy. Learn more: Policies and permissions in IAM: session policies (opens in a new tab)
C. Wrong: A permissions boundary applies to the role itself for every session, so the role's other releases and jobs would be limited too. It cannot be set differently for each job. Learn more: Permissions boundaries for IAM entities (opens in a new tab)
D. Wrong: A bucket policy can match a session name, but the job could choose any name, and the policy would have to change for each release. It is not a control the security team can rely on for this purpose.

Explanation

A session policy passed with AssumeRole narrows one session's permissions, and the effective permissions are the overlap of the role policy and the session policy. The job gets write access only to its release bucket, and the role does not change. Per-release roles add upkeep, while a permissions boundary and session names apply to the whole role or are not reliable controls.

DOP-C02 practice question: Least privilege, permissions boundaries and ABAC (2 of 3)

Explanation

Study

Keep practicing