A case-management app grants access when the caller’s PrincipalTag Department equals department tags on case-folder resources. Which authorization model is this?
Select an answer to reveal the explanation.
Short Explanation
ABAC is the matching-sticker rule: department tag on the badge must match department tag on the case folder. That scales cleaner than minting a unique access key per drawer. Public-read and AdministratorAccess are not attribute-based control.
Full Explanation
Granting access when the caller’s PrincipalTag Department equals department tags on case-folder resources is attribute-based access control (ABAC). IAM condition keys compare principal tags to resource tags so authorization scales as new departments and folders appear without rewriting a unique policy document per folder. Case-management platforms use ABAC to keep municipal tenancy rules data-driven and consistent across S3 prefixes or other tagged resources.
Mandatory sharing of one access key per department folder is credential sprawl, not ABAC. Anonymous S3 public-read on every folder tagged Department removes authentication while pretending tags alone are a control. Replacing all tags with a single AdministratorAccess managed policy abandons attribute-based restrictions entirely.
Exam caveat: ABAC depends on consistent tagging discipline and correct condition keys; mis-tagged resources can fail closed (or, if miswritten, fail open)—design and test both. Operational check: tag a principal and a case folder with matching Department values and allow access; change one tag without editing the policy and confirm access is denied for the mismatched pair. For municipal workloads, document the chosen pattern in the runbook so the next on-call engineer applies the same control instead of inventing a weaker shortcut under pressure.