Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An organization runs automated database backup scripts on its on-premises servers. These scripts need to upload backups to an Amazon S3 bucket. To comply with security best practices, the organization wants to avoid storing long-term access keys on the physical servers. Which IAM solution should the organization implement to grant these scripts secure, temporary access?

  1. AWS IAM Roles AnywhereAnswer
  2. B
    An IAM group with programmatic access keys shared among the physical servers
  3. C
    The AWS account root user access keys stored in a secure local configuration file
  4. D
    An IAM user with a policy allowing S3 access and access keys rotated manually every year

Answer

AWS IAM Roles Anywhere
AWS IAM Roles Anywhere is the correct solution because it allows workloads running outside of AWS, such as on-premises servers, to use digital certificates to authenticate and obtain temporary AWS credentials by assuming an IAM role. This eliminates the security risk of storing long-term AWS access keys on physical infrastructure.

Step-by-Step Solution

1
Identify the requirements: the workload runs on-premises, needs access to Amazon S3, and must not store long-term access keys.
Conclude that standard IAM roles cannot be directly assumed by on-premises servers without a secure mechanism to authenticate them.
On-premises servers do not have access to the AWS Instance Metadata Service, which automatically distributes credentials to AWS-native resources.
2
Evaluate AWS services designed for hybrid security integration.
Determine that AWS IAM Roles Anywhere is the designated feature that allows external workloads to exchange X.509 digital certificates for temporary AWS credentials.
This establishes trust between the on-premises environment and AWS to provision short-term security credentials dynamically without storing long-term access keys.

Key Concept

AWS IAM Roles Anywhere provides temporary security credentials for workloads outside of AWS.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic