Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A retail company is migrating its inventory management system to AWS. The system runs on Amazon EC2 instances and requires permission to write to an Amazon DynamoDB table. Additionally, a team of developers requires access to perform administrative tasks. Which of the following actions represent AWS-recommended security practices for managing access in this scenario? (Select TWO.)

  1. Configure an IAM role with permissions to access DynamoDB and associate it with the EC2 instances.Answer
  2. Organize the developers into an IAM user group and attach policies directly to the group rather than to individual users.Answer
  3. C
    Share the AWS account root user credentials with the lead developer to perform administrative tasks.
  4. D
    Embed long-term AWS access keys for an IAM user inside the EC2 application configuration files to access the DynamoDB table.
  5. E
    Request that AWS Support configures the permissions and manages user credentials for the developers.

Answer

The correct practices are configuring an IAM role for the EC2 instances to access the database, and organizing developers into an IAM user group with attached policies.
The correct practices are configuring an IAM role with the appropriate permissions and associating it with the EC2 instances, which allows the application to securely access DynamoDB using temporary credentials. Additionally, organizing developers into an IAM user group and attaching policies directly to the group ensures consistency and simplifies administration, aligning with IAM best practices.

Step-by-Step Solution

1
Analyze the requirement for the application on EC2 to access DynamoDB.
Determine that assigning an IAM role to the EC2 instances is the AWS-recommended method, avoiding hardcoded credentials.
This uses temporary security credentials, aligning with the principle of least privilege and credential rotation.
2
Analyze the requirement for developers to perform administrative tasks.
Determine that placing developers into an IAM user group and attaching policies to the group is the recommended practice.
This simplifies permission management and prevents configuration drift among individual user accounts.
3
Evaluate and eliminate incorrect practices.
Reject options recommending root user sharing, long-term embedded credentials, or delegating credential configuration to AWS Support.
These violate root user safety, credential management best practices, and the Shared Responsibility Model boundaries respectively.

Key Concept

AWS IAM best practices including IAM roles for EC2, IAM groups for user management, and the Shared Responsibility Model.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic