Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A startup is configuring access permissions for a newly deployed multi-tier application. An Amazon EC2 instance needs to retrieve configuration files from an Amazon S3 bucket, while an external systems administrator requires temporary access to troubleshoot EC2 configurations. Which two of the following options represent AWS-recommended practices for securing these access requirements?

  1. Attach an IAM role with S3 read-only permissions to the EC2 instance to grant the application temporary access credentials.Answer
  2. Configure an IAM role with EC2 administrative permissions for the external administrator to assume for a limited duration.Answer
  3. C
    Use the AWS Account Root User access keys directly in the EC2 instance configuration to ensure the application has constant access.
  4. D
    Create a permanent IAM user for the EC2 instance and hardcode its access key ID and secret access key into the application code.
  5. E
    Rely on AWS to automatically configure and manage the guest operating system's firewall rules and local user accounts on the EC2 instance.

Answer

The correct practices are to attach an IAM role with S3 read-only permissions to the EC2 instance and to configure an IAM role with EC2 administrative permissions for the external administrator to assume for a limited duration.
Attaching an IAM role with S3 permissions to the EC2 instance ensures the application dynamically acquires temporary credentials, avoiding hardcoded secrets. Additionally, setting up an IAM role with EC2 administrative permissions that the external administrator can assume ensures they only have administrative access for a limited, controlled duration.

Step-by-Step Solution

1
Analyze the access requirement for the EC2 instance.
The application running on the instance requires access to S3. AWS recommends using IAM roles to delegate temporary credentials to applications instead of using long-term access keys.
This secures EC2-to-S3 access without exposing long-term secrets.
2
Analyze the access requirement for the external systems administrator.
The administrator only needs access temporarily. AWS recommends using assume-role configurations to grant temporary credentials for third parties or administrative tasks.
This ensures the administrative permissions expire after a set time, reducing the attack surface.
3
Evaluate the distractors against AWS best practices and the Shared Responsibility Model.
Using the root account, using hardcoded IAM user access keys, and expecting AWS to manage OS-level settings all violate AWS practices.
This confirms the two chosen answers are the only correct and secure solutions.

Key Concept

Securing applications and users using IAM roles to provide temporary credentials and adhering to the Shared Responsibility Model.
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic