Question

An organization wants to delegate access to a set of users from the development environment so that they can access some resources in the production environment which is managed under another AWS account. As a solutions architect, which of the following steps would you recommend?

a) Create IAM roles in the production account and grant cross-account access to the development account
b) Share access keys between the development and production environments
c) Duplicate IAM users in both the development and production accounts
d) Use AWS Security Groups to manage cross-account access

Answer 1

The best practice is to create IAM roles in the production account with cross-account access permissions and establish a trust relationship with the development account. This approach enables secure access without sharing keys or duplicating users, which poses security risks.

Step-by-step explanation:

If an organization wants to delegate access to a set of users from the development environment so that they can access some resources in the production environment managed under another AWS account, I would recommend creating IAM roles in the production account and granting cross-account access to the development account.

This is the most secure and manageable approach to providing access between AWS accounts.

To implement this, you should:

1. Create an IAM role in the production account with permissions that specify what resources the development account users can access.
2. Establish a trust relationship between the production and development accounts by modifying the IAM role's trust policy to allow the development account to assume the role.
3. Instruct users in the development account to assume the IAM role when they need access to the production environment.

Sharing access keys or duplicating IAM users across accounts is not advisable due to security risks and the complexity of managing credentials.

Using AWS Security Groups is not relevant, as they are used to control inbound and outbound traffic to EC2 instances and other resources, not for managing permissions or identities.