Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An enterprise is establishing access policies for a newly deployed reporting service hosted on an Amazon EC2 instance and a database administrator who requires CLI access for database maintenance. Which of the following identity configurations represent AWS-recommended practices? (Select TWO.)

  1. Create an IAM role with permissions to read the database and attach it to the EC2 instance.Answer
  2. Create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.Answer
  3. C
    Create access keys for the AWS account root user to authenticate the EC2 instance's reporting service.
  4. D
    Generate an IAM user account for the reporting service and embed its permanent access keys in the application code.
  5. E
    Request that AWS Support staff perform the database maintenance and configure database user access levels.

Answer

Create an IAM role with permissions to read the database and attach it to the EC2 instance, and create an IAM user for the database administrator, configure API access keys, and assign a policy containing the minimum required permissions.
The correct configurations involve using an IAM role for the EC2 instance and a dedicated IAM user with restricted permissions for the administrator. Attaching an IAM role to the EC2 instance enables the reporting service to securely access the database using automatically rotated temporary credentials. For the database administrator, a dedicated IAM user with CLI access keys and least-privilege policies ensures accountable, secure programmatic access.

Step-by-Step Solution

1
Analyze the security requirements for the EC2-hosted application.
The application needs access to the database without exposing long-term credentials.
AWS best practices recommend using IAM roles for applications running on EC2 instances to obtain temporary credentials.
2
Analyze the access requirements for the database administrator.
The administrator needs programmatic access (CLI) to perform manual maintenance.
For human programmatic access, a dedicated IAM user with CLI access keys and least-privilege policies should be created.
3
Identify and eliminate options proposing insecure practices or boundary violations.
Using root user access keys, embedding permanent credentials, or requesting AWS to perform database maintenance are incorrect.
These violate root user best practices, credential storage standards, and the AWS Shared Responsibility Model.

Key Concept

Identity and Access Management (IAM) Best Practices
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic