Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A company runs an application on an Amazon EC2 instance. The application needs to read and write items in an Amazon DynamoDB table. According to AWS security best practices, which approach should a solutions architect use to grant the application access to the DynamoDB table?

  1. Create an IAM role with the required DynamoDB permissions and attach it to the EC2 instance profile.Answer
  2. B
    Configure the application to use the AWS account root user access keys to guarantee full access to the DynamoDB table.
  3. C
    Create an IAM user with programmatic access keys, embed the keys directly inside the application's configuration files, and deploy the application.
  4. D
    Store the IAM user access keys as a plaintext parameter in Systems Manager Parameter Store and configure the application to retrieve them.

Answer

Create an IAM role with the required DynamoDB permissions and attach it to the EC2 instance profile.
Creating an IAM role and attaching it to the EC2 instance profile allows the application to automatically and securely obtain temporary credentials. This eliminates the need to manage, distribute, or rotate long-term credentials, adhering to AWS security best practices.

Step-by-Step Solution

1
Define an IAM policy that grants the required read and write actions on the specific DynamoDB table.
An IAM policy document containing the necessary DynamoDB permissions is created.
This enforces the principle of least privilege by restricting access to only the necessary table and actions.
2
Create an IAM role and attach the DynamoDB policy to it.
An IAM role with the correct permissions is created.
Roles are designed to be assumed by AWS services, allowing them to obtain temporary credentials.
3
Attach the IAM role to an EC2 instance profile and associate the instance profile with the EC2 instance.
The EC2 instance is configured with the IAM role.
This allows the application running on the EC2 instance to automatically retrieve temporary credentials via the Instance Metadata Service (IMDS).

Key Concept

AWS service authentication using IAM roles and instance profiles to avoid long-term credentials.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic