Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A government transit agency runs a fleet of on-premises database servers and also hosts application servers on Amazon EC2. The agency needs to configure a nightly backup process that uploads database logs to a secured Amazon S3 bucket, while strictly adhering to the principle of least privilege and avoiding the use of long-term credentials on any server. Which TWO of the following configurations represent AWS-recommended security practices for this architecture?

  1. Attach an IAM role to the Amazon EC2 instances hosting the application servers to grant temporary security credentials for Amazon S3 bucket access.Answer
  2. Use AWS IAM Roles Anywhere to allow the on-premises database servers to assume an IAM role and obtain temporary security credentials using X.509 digital certificates.Answer
  3. C
    Generate an access key and secret access key for the AWS account root user and configure them on the application servers.
  4. D
    Create a single IAM user, share its access keys across all database servers, and disable multi-factor authentication (MFA) to prevent automated script interruption.
  5. E
    Configure a public Amazon S3 bucket policy and rely on the shared responsibility model to ensure that AWS automatically blocks unauthorized uploads from external networks.

Answer

The correct configurations are attaching an IAM role to the EC2 instances for application server access, and using AWS IAM Roles Anywhere to allow the on-premises database servers to obtain temporary credentials using X.509 digital certificates.
AWS-recommended security practices mandate the use of temporary credentials instead of long-term access keys whenever possible. Attaching an IAM role to EC2 instances allows applications running on them to access AWS resources using temporary, rotated credentials without storing secrets. For resources outside of AWS, such as the on-premises database servers, AWS IAM Roles Anywhere provides a secure way to exchange X.509 digital certificates for temporary AWS credentials, eliminating the need for long-term IAM user access keys on physical hardware.

Step-by-Step Solution

1
Analyze the organization's requirements for nightly database backups to Amazon S3.
Identify that the solution must support EC2 application servers and on-premises database servers while avoiding the use of long-term credentials on any system.
To determine which IAM features can provide temporary credentials for both AWS-native and non-AWS environments.
2
Evaluate options for providing credentials to the EC2 application servers.
Confirm that attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials without hardcoding secrets.
To securely grant access to AWS resources from EC2 instances in accordance with the principle of least privilege.
3
Evaluate options for providing credentials to the on-premises database servers.
Identify AWS IAM Roles Anywhere as the mechanism to obtain temporary AWS security credentials using X.509 certificates.
To extend the use of temporary IAM roles to workloads running outside of AWS, avoiding static keys on on-premises hardware.
4
Rule out options recommending root user access keys, static shared IAM users, or public access policies.
Exclude root user credential generation, static IAM user key distribution, and public bucket policies as they violate the principle of least privilege and root user best practices.
To avoid severe security risks and adhere to the customer's responsibility under the AWS Shared Responsibility Model.

Key Concept

Identity and Access Management (IAM)
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic