A company is configuring access for two new entities: a monitoring application running on an on-premises server that requires read-only access to Amazon CloudWatch, and a new human administrator who needs full access to manage Amazon EC2 resources. Which IAM identities should the company create to provide secure access for these entities? (Select TWO)
- An IAM role to provide temporary credentials for the monitoring applicationAnswer
- An IAM user to provide access credentials for the human administratorAnswer
- CThe AWS account root user to allow the human administrator to perform daily tasks
- DAn IAM role to serve as the permanent console username and password for the human administrator
- EAn AWS Support ticket requesting AWS to configure and manage the credentials for the monitoring application
Answer
The correct answers are the option to use an IAM role to provide temporary credentials for the monitoring application, and the option to use an IAM user to provide credentials for the human administrator.
The correct options are using an IAM role for the monitoring application and an IAM user for the human administrator. For applications, especially those on-premises, using IAM roles (via AWS IAM Roles Anywhere or federation) allows them to assume temporary credentials, which is a security best practice over using permanent credentials. For human administrators performing daily console tasks, creating dedicated IAM users provides isolated, long-term login credentials with specific policies, adhering to the principle of least privilege.
Step-by-Step Solution
Key Concept
AWS Identity and Access Management (IAM) entities (Users and Roles) and security best practices.