Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A financial services company is setting up its application environment on AWS. The environment will consist of developers who need to configure resources and applications running on Amazon EC2 instances that need to retrieve data from Amazon S3. Which two of the following actions align with AWS-recommended security best practices for managing identity and access in this scenario?

  1. Configure an IAM role with the required Amazon S3 access permissions and attach it to the Amazon EC2 instances.Answer
  2. Enable Multi-Factor Authentication (MFA) on the AWS account root user and restrict its use to only essential account management tasks.Answer
  3. C
    Generate long-term IAM access keys for the applications and store them directly within the application configuration files on the EC2 instances.
  4. D
    Use the AWS account root user for daily administrative and development tasks to simplify resource management.
  5. E
    Rely on AWS to automatically configure and audit all user permissions inside the operating systems of the EC2 instances.

Answer

The correct practices are configuring an IAM role with S3 permissions for the EC2 instances, and enabling MFA on the root user while restricting its daily usage.
Configuring an IAM role for EC2 instances allows applications to securely access Amazon S3 using temporary, auto-rotated credentials. Additionally, securing the root user with Multi-Factor Authentication (MFA) and restricting its use to essential tasks protects the account from unauthorized administrative actions.

Step-by-Step Solution

1
Evaluate application-to-service access requirements.
Identify that applications running on Amazon EC2 need to access Amazon S3. AWS best practice is to assign roles with temporary credentials rather than hardcoding static access keys.
This limits the risk of credential leakage and simplifies secret rotation.
2
Evaluate root account management policies.
Identify that the AWS account root user must be secured with Multi-Factor Authentication (MFA) and restricted from daily operations.
This protects the account from unauthorized administrative actions since root privileges cannot be limited.
3
Evaluate shared responsibility boundaries.
Understand that customer operating system user permissions inside EC2 instances are managed by the customer, not AWS.
This ensures the security configuration matches the company's internal compliance requirements.

Key Concept

AWS IAM security best practices, including temporary credentials via roles and root user protection.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic