Question 8
Domain 1: Design Secure ArchitecturesSebuah tim security melakukan review dan menemukan bahwa sebuah **IAM role di-assume oleh role lain, yang kemudian di-assume oleh role lain lagi** (role chaining). Mereka khawatir dengan implikasi security dari pola ini. Pernyataan mana yang benar tentang IAM role chaining?
Correct answer: B
Explanation
IAM role chaining is limited by STS: when a role is assumed using temporary credentials from another assumed role, the session duration is capped at 1 hour. This prevents chained sessions from using the longer duration allowed for a single role assumption, so the chain cannot be extended beyond that limit.
Why each option is right or wrong
A. Role chaining tidak dibatasi — bisa chain role sebanyak apapun dengan duration session normal
B. Saat role chaining, **maximum session duration dibatasi menjadi 1 jam**, tidak bisa di-extend seperti single role assumption
AWS STS role chaining is explicitly capped at 1 hour: when temporary credentials from one assumed role are used to assume another role, the resulting session duration cannot exceed 3,600 seconds. Under the IAM/STS role assumption rules, a single role assumption can be configured up to the role’s maximum session duration (between 1 and 12 hours), but chained assumptions are forced back to the 1-hour limit, so the session cannot be extended beyond that by successive chaining.
C. Role chaining otomatis di-block oleh AWS sebagai security measure
D. Role chaining hanya bisa dilakukan oleh root account