ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS DevOps Engineer Professional All Questions

View all questions & answers for the AWS DevOps Engineer Professional exam
Go to Exam

Exam AWS DevOps Engineer Professional topic 1 question 154 discussion

Exam question from Amazon's AWS DevOps Engineer Professional
Question #: 154
Topic #: 1
[All AWS DevOps Engineer Professional Questions]

An ecommerce company has chosen AWS to host its new platform. The company's DevOps team has started building an AWS Control Tower landing zone. The DevOps team has set the identity store within AWS Single Sign-On (AWS SSO) to external identity provider (IdP) and has configured SAML 2 0.

The DevOps team wants a robust permission model that applies the principle of least privilege. The model must allow the team to build and manage only the team's own resources.

Which combination of steps will meet these requirements? (Choose three.)

  • A. Create IAM policies that include the required permissions. Include the aws PrincipalTag condition key.
  • B. Create permission sets. Attach an inline policy that includes the required permissions and uses the aws:PrincipalTag condition key to scope the permissions.
  • C. Create a group in the IdP. Place users in the group. Assign the group to accounts and the permission sets in AWS SSO.
  • D. Create a group in the IdP. Place users in the group. Assign the group to OUs and IAM policies.
  • E. Enable attributes for access control in AWS SSO. Apply tags to users. Map the tags as key-value pairs.
  • F. Enable attributes for access control in AWS SSO. Map attributes from the IdP as key-value pairs.
Show Suggested Answer Hide Answer
Suggested Answer: BCF 🗳️
by Dimidrol at Jan. 17, 2023, 11:39 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
easytoo
1 year, 12 months ago
BCF is best.
upvoted 1 times
...
Bulti
2 years, 2 months ago
B, C and F seems correct. Using the principalTag in the Permission Set inline policy a logged in user belonging to a specific AD group in the IDP can be permitted access to perform operations on certain resources if their group matches the group used in the PrincipleTag. Basically you are narrowing the scope of privileges assigned via Permission policies conditionally based on whether the logged in user belongs to a specific AD Group in IDP. The mapping of the AD group to the request attributes can be done using SSO attributes where we can pass other attributes like the SAML token as well.
upvoted 3 times
Bulti
2 years, 2 months ago
https://docs.aws.amazon.com/singlesignon/latest/userguide/abac.html
upvoted 1 times
...
...
saeidp
2 years, 3 months ago
Selected Answer: BCF
B C F for me
upvoted 1 times
...
Dimidrol
2 years, 3 months ago
Selected Answer: BCF
B C F for me
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago