What is the best practice for applying permissions to many users who perform the same job?

Question

BlackTom AI · Accepted Answer

The question asks for the best practice when applying permissions to many users who perform the same job. 
Option 1: 'Apply a permissions policy to an IAM Role and allow the users to assume the role' This is a common pattern for temporary elevation or for role-based access, but it adds an extra step for each user to assume the role and is typically used for short-term access or cross-account scenarios. For many users who share a job, this is more complex than necessary and can complicate auditing and daily use. 
Option 2: 'Add the users to an IAM Group and apply a permissions policy to the group' This aligns with the principle of group-based access control: manage permissions in one place for all users in the group, making onboarding and offboarding easier and ensuring consistent permissions across all users in that role. It scales well for many users and is a standard best practice in IAM management. 
Option 3: 'Add an inline permissions policy to each individual IAM user' Inline policies attach directly to users and do not leverage the benefits of central management. This approach becomes difficult to maintain as the user base grows, increases the risk of drift, and makes updates labor-intensive since every user’s policy must be changed individually. 
Option 4: 'All of the above' This would imply that using roles, groups, and inline user policies are all equally valid for the same scenario. In practice, while there are situations where multiple methods are used (e.g., temporary role assumption or per-user exceptions), for the stated scenario of many users with the same job, the group-based approach is the most scalable and maintainable; the other options are suboptimal in typical large-user scenarios.

In summary, option 2 provides a scalable, maintainable, and widely recommended approach for managing permissions for a large set of users performing the same function, while options 1 and 3 introduce unnecessary complexity or maintenance challenges. Option 4 would only be appropriate if all the listed methods were equally suitable for the given context, which is not the case here.

What is the best practice for applying permissions to many users who perform the same job?单项选择题

类似问题

What components ensure secure access and management of user identities within the digital ecosystem?

Which IAM security practices are recommended? (Select ALL that apply)

Which of the following describes a security best practice that can be implemented by using AWS Identity and Access Management (IAM)?

Which of the following are best practices to secure your account using the identity and Access Management (IAM)? (Choose 2)

Which AWS service enables identity and access management?

With AWS IAM, you can manage which THREE of the following?

Which of the followings is not an AWS IAM identity?

Which domain contains critical systems and applications that support and provide various services that perform core functions like authentication, authorization, and data management?

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单