Which solution will meet these requirements in the MOST secure manner?
Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to an IAM user. Share the user credentials with the security administrator.
Create an IAM policy in each developer account that has administrator access to all Amazon EC2 actions, including VPC actions. Assign the policy to an IAM user. Share the user credentials with the security administrator.
Create an IAM policy in each developer account that has administrator access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.
Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.
Explanations:
While this option provides read-only access to VPC resources, sharing user credentials poses a security risk, as it violates the principle of least privilege and could lead to unauthorized access.
This option grants administrator access to all EC2 actions, which includes more permissions than necessary for reviewing VPC configurations. Sharing credentials increases the risk of misuse and is not a secure practice.
Although this option creates an IAM role with administrator access related to VPC resources, it grants excessive permissions for the specific need of reviewing VPC configurations, violating the principle of least privilege.
This option creates a cross-account IAM role with read-only access to VPC resources, which adheres to the principle of least privilege. It allows the security administrator to assume the role securely without sharing credentials, thus maintaining a more secure environment.
In my opinion, the answer is:
Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.
If I had to guess, I’d say the answer is:
Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.