A new deployment engineer will use AWS CloudFormation templates to create multiple AWS resources. A solutions architect wants the engineer to operate under least privilege. Which combination of actions should the solutions architect take? (Choose two.)
Choose an answer
Tap an option to check your answer.
Correct answer: Create a new IAM user for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only., Create an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using that IAM role..
Why this is the answer
The correct options demonstrate the principle of least privilege. Creating a new IAM user for the deployment engineer and assigning them to a group with an IAM policy that grants only AWS CloudFormation actions ensures they can perform their job without unnecessary permissions. Similarly, creating an IAM role specifically for CloudFormation stack operations, which the engineer can assume, also adheres to least privilege by defining precise permissions for that task. Using AWS account root user credentials is a security anti-pattern and grants excessive privileges. Attaching the PowerUsers or AdministratorAccess IAM policies to a user or group also grants broad permissions beyond what is needed for CloudFormation operations, violating the principle of least privilege.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed