Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is setting up a new multi-department environment on AWS. The security team is defining identity and access management policies for corporate employees, applications running on Amazon EC2 instances, and administrative workflows. Which of the following are recommended AWS IAM best practices for managing access for these entities? (Select TWO.)

  1. Assign IAM roles to Amazon EC2 instances instead of storing long-term AWS access keys within the application code.Answer
  2. Use AWS IAM Identity Center to federate employee identities from the company's existing identity provider for console access.Answer
  3. C
    Create a single shared IAM user with administrator permissions for all developers to simplify credential rotation.
  4. D
    Use the AWS account root user for daily administrative and deployment tasks to ensure full visibility.
  5. E
    Rely on AWS to automatically manage and rotate access keys stored within customer application code on Amazon EC2 instances.

Answer

Assigning IAM roles to Amazon EC2 instances to avoid storing hardcoded credentials, and using AWS IAM Identity Center to federate employee identities from an existing identity provider.
The correct practices are to assign IAM roles to EC2 instances so applications can access resources using temporary security credentials, and to use AWS IAM Identity Center to federate employee identities from an existing identity provider. This aligns with the principle of least privilege and avoids managing long-term static credentials.

Step-by-Step Solution

1
Analyze the credentials requirement for applications running on Amazon EC2 instances.
Identify that applications should use temporary credentials retrieved dynamically using IAM roles, rather than storing long-term credentials in the code.
This reduces the risk of credential exposure and complies with AWS security best practices.
2
Analyze the credentials requirement for corporate employee login access.
Identify that centrally managed single sign-on using AWS IAM Identity Center federated with the existing identity provider is the recommended approach.
Federation enables centralized administration, enforces security controls like MFA, and eliminates the need to manage separate long-term IAM users.

Key Concept

AWS IAM best practices for managing credentials and access for applications and human users
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic