DOP-C02 practice question: Least privilege, permissions boundaries and ABAC (3 of 3)
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A game studio sends player-analytics exports to a third-party vendor. The vendor's software assumes a role in the studio's account to read the export files in one S3 prefix, and the studio has allowed the vendor's AWS account in the role's trust policy.
The security team is concerned about the confused deputy problem: another customer of the same vendor could ask the vendor's software to assume this role on their behalf. The studio wants only its own vendor integration to be able to use the role.
The vendor's software already sends an external ID that the vendor assigns to each customer, and the studio can change the trust policy and the role's permissions.
Which change meets these requirements?
Choose one answer.
AA. Create an IAM user for the vendor in the studio's account, and give the vendor its access key, so that the vendor no longer needs to assume a role at all.
BB. Keep the trust policy as it is, and add a deny on the role for the vendor's account, with an exception for the vendor's main account role that the studio names.
CC. Make the S3 export bucket public for read-only access, so that the vendor can read the prefix without assuming any role, and remove the role from the account entirely.
DD. Require sts:ExternalId in the trust policy to match the unique external ID that the vendor assigned to the studio, and limit the role to read access on the export prefix.
Show the answer and explanation
Answer: D
A. Wrong: A long-lived access key for the vendor is a credential that can leak, and it does not address how the vendor's role is used. The studio would also lose the temporary, scoped access that the role gives.
B. Wrong: A deny that names the vendor's account does not stop other customers of the vendor from using their own calls. The confusion is about which request the vendor acts on, not which account owns it.
D. Right: Correct. The ExternalId condition allows the role to be assumed only when the vendor's call carries the studio's unique value, so a request made for another customer fails. Read-only permissions on one prefix limit what the role can reach. Learn more: Access to AWS accounts owned by third parties (opens in a new tab)
Explanation
The confused deputy problem is addressed by requiring an sts:ExternalId in the role's trust policy, which the vendor must supply on each AssumeRole call. Keeping the role's permissions limited to read access on one prefix bounds what it can reach. Access keys, account-level denies and public buckets each leave the studio open to misuse or exposure.
Want more on Least privilege, permissions boundaries and ABAC? The 5 full-length practice sets have 14 more Least privilege, permissions boundaries and ABAC questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →