Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A gaming company has a mobile application that needs to securely write game state files to an Amazon S3 bucket. Millions of players will use this application, and they must not have permanent AWS credentials embedded in the app code. Which approach should the company use to grant this access?

  1. A
    Create a single IAM user with write permissions, generate long-term access keys, and embed them in the application code.
  2. B
    Use the AWS account root user access keys to authenticate each mobile application session directly.
  3. Authenticate users through a public identity provider and assume an IAM role to obtain temporary security credentials.Answer
  4. D
    Require AWS to automatically authenticate the client-side mobile hardware under the AWS shared responsibility guidelines.

Answer

Authenticate users through a public identity provider and assume an IAM role to obtain temporary security credentials.
The correct approach is to authenticate users via a public identity provider and assume an IAM role. This leverages web identity federation, allowing mobile users to obtain temporary, limited-privilege security credentials to access Amazon S3 without embedding permanent access keys in the application binary.

Step-by-Step Solution

1
Analyze the requirement of providing access to millions of external mobile application users without embedding static credentials.
Eliminate solutions involving long-term access keys or static IAM user credentials.
Embedding static keys in client-side applications exposes them to extraction.
2
Identify the AWS mechanism designed for providing temporary credentials to external users.
Select IAM roles as the mechanism to provide temporary security credentials.
IAM roles provide short-lived, auto-rotating credentials.
3
Determine how external mobile users can be authenticated before assuming the role.
Use web identity federation with an OIDC-compatible identity provider.
This allows external users to authenticate using existing identity providers (like Google or Amazon) to assume the role.

Key Concept

Temporary security credentials via IAM roles and web identity federation
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic