Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A retail company is designing its access management strategy on AWS. The company needs to configure access for its application developers and an application running on an Amazon EC2 instance. Which of the following actions follow AWS Identity and Access Management (IAM) best practices? (Select TWO.)

  1. Organize developer IAM users into an IAM group and attach permissions policies directly to the group.Answer
  2. Attach an IAM role to the Amazon EC2 instance to grant the application temporary credentials for accessing other AWS resources.Answer
  3. C
    Store permanent IAM access keys in the application's configuration files on the EC2 instance.
  4. D
    Share the AWS account root user credentials with the lead developers to simplify administrative tasks.
  5. E
    Rely on AWS to manage and rotate IAM user access keys under the Shared Responsibility Model.

Answer

Organizing developer IAM users into an IAM group and attaching permissions to the group, and attaching an IAM role to the Amazon EC2 instance to grant the application temporary credentials.
Organizing developer IAM users into an IAM group and attaching policies to the group makes permission management efficient and consistent. Attaching an IAM role to the Amazon EC2 instance ensures the application uses temporary, secure credentials rather than hardcoded secrets.

Step-by-Step Solution

1
Determine how to manage credentials for applications running on Amazon EC2 instances.
IAM roles should be used to provide temporary, automatically rotated security credentials to applications.
This avoids storing permanent, hardcoded access keys on the instance, which is a major security risk.
2
Determine how to manage permissions for multiple application developers.
IAM users should be added to an IAM group, and policies should be attached to the group rather than individual users.
This simplifies administration and ensures consistent permissions management as the team changes.
3
Examine the remaining options against the AWS Shared Responsibility Model and root account best practices.
Sharing root user credentials and expecting AWS to rotate customer access keys are flagged as incorrect.
The root user must not be shared for daily tasks, and managing IAM credentials falls under the customer's responsibility for security in the cloud.

Key Concept

AWS Identity and Access Management (IAM) Best Practices
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic