Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A university IT department is setting up its AWS environment. The administrator needs to configure permissions for two scenarios: first, allowing an Amazon EC2 instance to securely write logs to an Amazon CloudWatch Logs stream; second, organizing access for ten lab students who all require identical read-only permissions to Amazon S3. Which of the following IAM solutions represent AWS best practices for these scenarios? (Select TWO.)

  1. Attach an IAM role to the Amazon EC2 instance to grant the required CloudWatch Logs write permissions.Answer
  2. Place the ten lab student IAM users into an IAM group and attach a managed S3 read-only policy to that group.Answer
  3. C
    Generate a set of long-term access keys for the EC2 instance and save them in the instance's local configuration files.
  4. D
    Share the AWS account root user credentials with the ten lab students so they can access S3 without creating individual accounts.
  5. E
    Request AWS to manage the EC2 operating system patches and log configurations under the AWS Shared Responsibility Model.

Answer

Attaching an IAM role to the EC2 instance for CloudWatch permissions, and placing the lab students into an IAM group with a managed S3 read-only policy attached to the group.
The correct options recommend attaching an IAM role to the EC2 instance and placing the lab students into an IAM group. Using IAM roles for EC2 instances allows them to securely access other AWS services using temporary credentials without storing permanent credentials. Placing users with identical access requirements into an IAM group allows permissions to be managed collectively, adhering to operational efficiency.

Step-by-Step Solution

1
Analyze the EC2 logging scenario to determine the secure way to grant permissions to AWS resources.
Identify that applications running on EC2 instances require temporary security credentials, which are securely provided using IAM roles rather than permanent access keys.
This aligns with the best practice of avoiding hardcoded long-term credentials.
2
Analyze the student access scenario to identify the most efficient way to manage identical permissions for multiple users.
Determine that placing the users in an IAM group and attaching the S3 read-only policy to the group is the recommended operational practice.
This simplifies permission management and ensures consistency across all identical users.

Key Concept

AWS IAM Best Practices for Access Management (Roles and Groups)
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic