Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A software developer needs to access Amazon S3 buckets using the AWS Command Line Interface (CLI) from their local development workstation. According to AWS security best practices, which method should the developer use to authenticate and run these commands?

  1. Use AWS IAM Identity Center to authenticate the session and obtain short-lived, temporary credentials.Answer
  2. B
    Generate a long-lived Access Key ID and Secret Access Key for the AWS account root user to avoid session timeouts.
  3. C
    Configure the AWS CLI to assume an IAM role directly without any primary identity or credential authentication.
  4. D
    Contact AWS Support to manage the security configurations and validate commands executed on the local workstation.

Answer

Use AWS IAM Identity Center to authenticate the session and obtain short-lived, temporary credentials.
Using AWS IAM Identity Center allows human users to authenticate and receive short-lived, temporary credentials for command-line access. This aligns with the security best practice of avoiding long-lived access keys, which are prone to accidental exposure.

Step-by-Step Solution

1
Determine the user type and access method.
A human developer requires programmatic access to AWS via the local CLI.
Identifying the actor and tool determines which credential strategies are applicable.
2
Evaluate credential lifetimes against AWS security best practices.
Temporary credentials should always be preferred over long-lived credentials for human access.
Minimizes the blast radius and risk of credential exposure.
3
Select the modern AWS service that provides temporary credentials via single sign-on.
AWS IAM Identity Center.
It dynamically issues short-lived programmatic credentials for the CLI and simplifies multi-account access.

Key Concept

IAM Credential Management and Best Practices
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic