Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A logistics company is deploying a tracking application on a fleet of Amazon EC2 instances that requires access to a private Amazon DynamoDB table. Additionally, an external audit team needs temporary access to view the company's billing dashboards for a period of one week. Which of the following configurations should the administrator implement to meet these requirements securely? (Select TWO.)

  1. Create an IAM role with DynamoDB access permissions and associate it with the EC2 instances using an instance profile.Answer
  2. Create an IAM role with billing read-only permissions that the external audit team can assume temporarily.Answer
  3. C
    Create a single IAM user, generate long-lived access keys, and hardcode them in the tracking application's configuration file on the EC2 instances.
  4. D
    Share the AWS account root user credentials with the external audit team for the duration of the audit, then change the password.
  5. E
    Configure a Network Access Control List (Network ACL) rule that permits the external audit team to bypass IAM authentication and log in directly to the console.

Answer

The correct configurations are to create an IAM role with DynamoDB access permissions for the EC2 instances, and to create an IAM role with billing read-only permissions that the external audit team can assume temporarily.
Creating an IAM role with DynamoDB access permissions and associating it with the EC2 instances allows the application to dynamically retrieve temporary credentials. Creating a separate IAM role with billing read-only permissions allows the external audit team to assume the role temporarily for the duration of the audit without possessing permanent user accounts.

Step-by-Step Solution

1
Evaluate the requirement for applications running on EC2 instances to access DynamoDB.
AWS security best practice dictates using IAM roles (attached via instance profiles) for application authentication rather than hardcoded long-lived credentials.
This prevents credentials leakage and automatically rotates temporary security credentials.
2
Evaluate the requirement to grant temporary access to external auditors for viewing billing dashboards.
Creating a dedicated IAM role for the third-party auditors to temporarily assume meets the security requirement.
This adheres to the principle of least privilege and avoids the need to share permanent root credentials or create long-term IAM users.

Key Concept

AWS Identity and Access Management (IAM) Roles and Access Control Best Practices
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic