Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An enterprise is launching a new microservice on Amazon Elastic Container Service (Amazon ECS) that needs to write data to an Amazon DynamoDB table. Which configuration represents the most secure method for granting the microservice the necessary permissions?

  1. A
    Create an IAM user with DynamoDB write permissions, generate permanent access keys, and store them in the application container code.
  2. Associate an IAM role with the container task definition, granting it temporary security credentials with write access to the DynamoDB table.Answer
  3. C
    Configure the container to use the AWS account root user access keys to ensure uninterrupted access to the DynamoDB database.
  4. D
    Request AWS Support to configure and manage the database access permissions within the container under the Shared Responsibility Model.

Answer

Associating an IAM role with the container task definition, granting it temporary security credentials with write access to the DynamoDB table.
Associating an IAM role with the ECS task definition is the recommended practice. It allows the microservice container to retrieve temporary security credentials automatically. This removes the need to store long-term, hardcoded access keys in the code or container environment, minimizing credential exposure.

Step-by-Step Solution

1
Identify the entity requiring access (a containerized application on ECS) and the target resource (DynamoDB table).
An application running on an AWS compute service needs access to an AWS database service.
Access requirements dictate what type of IAM identity is most appropriate (e.g., role vs. user).
2
Apply the AWS security best practice of using temporary security credentials for applications running on AWS services.
An IAM role must be created and associated with the container task definition rather than creating an IAM user with long-term access keys.
Roles provide temporary credentials that rotate automatically, avoiding the security risk of exposing hardcoded long-term credentials.
3
Define the scope of customer responsibility under the AWS Shared Responsibility Model.
The customer is responsible for configuring access policies and assigning IAM roles to resources.
AWS does not manage or configure resource-level permissions for the customer.

Key Concept

Using IAM roles to grant temporary credentials to AWS resources and applications
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic