Question

A new DevOps engineer has joined a large financial services company recently. As part of his onboarding, the IT department is conducting a review of the checklist for tasks related to AWS Identity and Access Management. As a solutions architect, which best practices would you recommend (Select two)?

a) Use IAM groups for permissions assignment
b) Share IAM user credentials between team members
c) Assign overly permissive IAM policies
d) Enable MFA (Multi-Factor Authentication) for IAM users

Answer 1

As a solutions architect for a financial services company, you would recommend two best practices for AWS Identity and Access Management (IAM), which are using IAM groups for permissions assignment and enabling MFA for IAM users.

Step-by-step explanation:

As a solutions architect, there are two best practices you can recommend:

1. Use IAM groups for permissions assignment: IAM groups allow you to group users with similar permissions together and simplify the management of permissions. By assigning permissions to groups, you can easily add or remove users from the group to grant or revoke permissions. This helps in maintaining consistent permissions across the organization.
2. Enable MFA (Multi-Factor Authentication) for IAM users: Enabling MFA adds an extra layer of security to IAM user accounts. With MFA, users need to provide an additional piece of authentication, such as a code from a mobile app or a physical token, in addition to their password, before they can access AWS resources. This helps in protecting against unauthorized access even if the user's password is compromised.