Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An organization wants to configure secure access to its AWS resources. They need to grant an application running on an Amazon EC2 instance access to an Amazon S3 bucket, and they need to configure access for a new team of system administrators. Which of the following AWS Identity and Access Management (IAM) practices should the organization implement? (Select TWO.)

  1. Associate an IAM role with the Amazon EC2 instance to grant the application temporary access to the S3 bucketAnswer
  2. B
    Store the AWS Account Root User access keys in the application configuration file on the EC2 instance
  3. Create individual IAM users for each system administrator and assign them to an IAM group with administrative policies attachedAnswer
  4. D
    Share a single administrative IAM user account and its password among all the system administrators to simplify access
  5. E
    Delegate user password rotation and permission management tasks to AWS support as part of the AWS infrastructure management

Answer

Associate an IAM role with the Amazon EC2 instance to grant the application temporary access to the S3 bucket, and create individual IAM users for each system administrator and assign them to an IAM group with administrative policies attached.
The correct practices are to associate an IAM role with the EC2 instance, allowing the application to securely obtain temporary credentials to access the S3 bucket, and to create individual IAM users inside an IAM group for the system administrators to manage their administrative access centrally and securely.

Step-by-Step Solution

1
Analyze the access requirement for the application on the EC2 instance.
The application needs access to an S3 bucket. The secure way to provide access to AWS services from an EC2 instance is by using IAM roles, which provide temporary security credentials.
This avoids hardcoding or storing long-term credentials like access keys on the instance.
2
Analyze the access requirement for the new team of system administrators.
Administrators require credentials to perform daily management tasks. Best practices dictate creating individual IAM users for accountability and placing them in an IAM group with the required administrative policies.
This facilitates easier permission management and ensures individual actions can be audited.
3
Evaluate the distractors based on security and shared responsibility principles.
Using the root account, sharing user credentials, and expecting AWS to manage customer permissions are violations of security best practices and the Shared Responsibility Model.
The root user must not be used for daily tasks, credential sharing ruins auditability, and access management is a customer responsibility.

Key Concept

AWS IAM Best Practices and Access Control
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic