Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A company is establishing its AWS environment and needs to define its identity and access management strategy. The security team must ensure that application servers running on Amazon EC2 can securely access files in Amazon S3, and that emergency administrative actions can be performed securely if primary identity systems fail. Which two AWS Identity and Access Management (IAM) best practices should the company implement? (Select TWO.)

  1. Associate an IAM role with the EC2 instances using an instance profile, allowing the application to use temporary security credentials.Answer
  2. Configure the AWS account root user with multi-factor authentication (MFA), secure its login credentials, and use it only for tasks that explicitly require root permissions.Answer
  3. C
    Create an IAM user for the application, generate long-term access keys, and store them directly in the application code on the EC2 instances.
  4. D
    Utilize the AWS account root user for daily administrative activities and share its credentials with the development team to simplify resource provisioning.
  5. E
    Apply a Service Control Policy (SCP) at the AWS Organizations level to grant direct read and write access to the S3 bucket.

Answer

The correct practices are to associate an IAM role with the EC2 instances using an instance profile and to configure the AWS account root user with multi-factor authentication (MFA) while securing its credentials for emergency-only use.
Associating an IAM role with an EC2 instance provides temporary security credentials dynamically, eliminating the need to store long-term access keys. Additionally, securing the AWS account root user with MFA and restricting its usage to emergency-only tasks is a fundamental AWS security best practice.

Step-by-Step Solution

1
Determine the secure method for applications running on Amazon EC2 to access other AWS services like Amazon S3.
Identify that AWS recommends attaching an IAM role to the EC2 instances using an instance profile to provide temporary credentials.
This avoids hardcoding or storing permanent AWS access keys on the instance, reducing credential exposure risk.
2
Determine the security recommendations for the AWS account root user.
Identify that the root user should have MFA enabled and be reserved only for tasks requiring root privileges, while regular administrative tasks should be performed by IAM identities.
Securing the root user protects the highest-privileged credentials in the AWS account from misuse or compromise.
3
Analyze and eliminate incorrect options based on security best practices.
Eliminate choices recommending permanent access keys, root credential sharing, or using Service Control Policies to grant direct S3 permissions.
These practices either compromise security or misapply the purpose of AWS Organizations and IAM components.

Key Concept

AWS IAM Best Practices for EC2 access and Root User Security
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic