A deployment package uses the AWS CLI to copy files into any S3 bucket in the account, using access keys stored in environment variables. The package is running on EC2 instances, and the instances have been modified to run with an assumed IAM role and a more restrictive policy that allows access to only one bucket.
After the change, the Developer logs into the host and still has the ability to write into all of the S3 buckets in that account. What is the MOST likely cause of this situation?

Question

A deployment package uses the AWS CLI to copy files into any S3 bucket in the account, using access keys stored in environment variables. The package is running on EC2 instances, and the instances have been modified to run with an assumed IAM role and a more restrictive policy that allows access to only one bucket.

After the change, the Developer logs into the host and still has the ability to write into all of the S3 buckets in that account. What is the MOST likely cause of this situation?

Rajeev Parameswaran · Accepted Answer

An IAM managed policy is being used on the IAM role

Rajeev Parameswaran · Answer

An IAM inline policy is being used on the IAM role

Rajeev Parameswaran · Answer

The AWS CLI is corrupt and needs to be reinstalled

Rajeev Parameswaran · Answer

The AWS credential provider looks for instance profile credentials last

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 87 - DVA-C01 discussion

Suggested answer: B

0 comments