Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A multi-department enterprise wants to secure its AWS environment by implementing the principle of least privilege and reducing security risks associated with credential management. The administrator must configure access for both developers (human users) and applications running on Amazon EC2 instances (machine identities). Which two methods represent AWS security best practices for managing these identities? (Select TWO.)

  1. Use AWS IAM Identity Center to federate human identities and centrally manage user access to AWS accounts.Answer
  2. Attach an IAM role to the Amazon EC2 instances to provide applications with temporary security credentials.Answer
  3. C
    Generate long-term IAM access keys for developers and store them in a shared configuration file on the instances.
  4. D
    Configure daily administrative operations to run under the AWS account root user credentials with multi-factor authentication (MFA) disabled for automation.
  5. E
    Create a shared IAM user account for each development team to minimize administrative overhead.

Answer

The correct practices are to use AWS IAM Identity Center for federated human access, and to attach IAM roles to Amazon EC2 instances for secure machine access using temporary credentials.
Centrally managing human user identities with AWS IAM Identity Center and using IAM roles to assign temporary credentials to EC2 instances are the industry-standard AWS best practices. They eliminate the need for permanent access keys, simplify credential rotation, and preserve detailed accountability in audit logs.

Step-by-Step Solution

1
Analyze the requirements for human identities (developers).
Identify that AWS IAM Identity Center is the modern, recommended approach to centrally manage federated human access instead of creating static IAM users.
Reduces credential management overhead and aligns with the best practice of avoiding long-term IAM user credentials.
2
Analyze the requirements for machine identities (applications running on EC2 instances).
Identify that IAM roles should be attached to EC2 instances to provide temporary, automatically rotated security credentials.
Eliminates the risk of hardcoding or storing long-term API access keys in application configuration files.
3
Evaluate the incorrect choices to ensure they violate AWS security best practices.
Confirm that using the root user, sharing IAM accounts, or storing long-term access keys on EC2 instances are insecure configurations.
These practices increase the attack surface and violate the principles of least privilege and individual accountability.

Key Concept

AWS IAM best practices for securing human and machine access using federation and temporary credentials.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic