Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

An enterprise is auditing its AWS environment. The audit team discovers that the development group shares a single set of IAM access keys to perform administrative actions. Additionally, the AWS account root user is frequently used to run daily database backup scripts. Which of the following actions should the security team take to remediate these security findings in accordance with AWS best practices? (Select TWO.)

  1. Create individual IAM users for each developer, assign them to an IAM group with an administrative policy attached, and require multi-factor authentication (MFA) for console access.Answer
  2. Configure an IAM role with the required permissions for the database backup scripts, and assign this role to the Amazon EC2 instance running the database.Answer
  3. C
    Generate a new set of access keys for the AWS account root user and update the database backup scripts to use these keys, keeping the root password confidential.
  4. D
    Create a single shared IAM user with administrator permissions for the database backup scripts and hardcode the user's access keys inside the script files.
  5. E
    Open an AWS Support ticket requesting that AWS automatically rotate and secure the shared development access keys under the AWS Shared Responsibility Model.

Answer

To remediate these issues, the security team should establish individual IAM users within an administrator group requiring MFA, and assign an IAM role to the EC2 instance hosting the database backup scripts.
Remediating administrative access requires implementing individual accountability. Creating individual IAM users, placing them into an administrative group, and enabling MFA ensures that administrative operations can be tracked and secured. For the backup scripts, assigning an IAM role directly to the EC2 instance allows it to retrieve temporary credentials automatically, removing both the root user dependency and the risk of exposing long-term access keys.

Step-by-Step Solution

1
Identify credentials risk for administrative staff.
Sharing a single set of IAM access keys prevents individual accountability and violates the principle of individual user identity.
Establishing individual IAM users mapped to groups with MFA enforces secure administrative access.
2
Identify credentials risk for the automated backup scripts.
Using the root user or root access keys for automated tasks presents an extreme security risk, as root access cannot be restricted.
Transitioning the script to use an IAM role attached to the EC2 instance provides secure, temporary credentials without hardcoded keys.
3
Map the remediation to AWS security best practices.
Select the options that implement individual IAM users/groups with MFA, and service roles for AWS compute resources.
This alignment ensures compliance with the principle of least privilege and credential safety.

Key Concept

Applying IAM identity best practices, securing the root account, using group-based permissions with MFA, and leveraging IAM roles for EC2 instances to avoid hardcoded credentials.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic