A company is deploying an application on Amazon EC2 instances that requires read and write access to an Amazon DynamoDB table. At the same time, the company needs to grant temporary access to external developers from a partner organization to collaborate on the project.
Which of the following actions align with AWS Identity and Access Management (IAM) best practices to meet these requirements? (Select TWO.)
- Assign an IAM role to the Amazon EC2 instances that grants the necessary permissions to access the Amazon DynamoDB table.Answer
- Configure a cross-account IAM role that the partner organization's developers can assume to access the required resources.Answer
- CCreate an IAM user, generate access keys, and embed them inside the application's configuration file on the EC2 instances.
- DShare the AWS account root user credentials with the partner developers so they can access all resources without restriction.
- EConfigure AWS to automatically manage and validate the application-level data permissions for the DynamoDB table.
Answer
Assign an IAM role to the Amazon EC2 instances to grant permissions to the DynamoDB table, and configure a cross-account IAM role for the partner developers to assume.
The correct options represent AWS best practices for identity management. Assigning an IAM role to the EC2 instances allows secure application-to-service communication via temporary credentials. Configuring a cross-account IAM role for the external developers provides secure, temporary access to the partner organization without requiring new user creation or credential sharing.
Step-by-Step Solution
Key Concept
AWS identity management best practices prioritize the use of temporary credentials via IAM roles for applications and third-party cross-account access, while strictly avoiding the use of long-term credentials or root accounts for operational tasks.