A company is designing the security architecture for a new application. The development team, consisting of 50 engineers who are managed in an on-premises Active Directory, needs administrator access to the AWS Management Console. Additionally, the application requires access to a database password that must be rotated every 30 days. The solution must follow AWS security best practices.
Which combination of actions should a solutions architect recommend? (Select TWO.)
- Configure AWS IAM Identity Center to federate the on-premises Active Directory and grant console access to the engineers.Answer
- Store the database password in AWS Secrets Manager and enable automatic rotation every 30 days.Answer
- CCreate individual IAM users with long-term credentials for each engineer and manually configure password policies.
- DStore the database password as a plaintext parameter in Systems Manager Parameter Store and use an Amazon EventBridge rule to update it monthly.
- EShare the AWS account root user credentials with the engineering lead to manage resources and perform administrative tasks.
Answer
The correct actions are to configure AWS IAM Identity Center to federate the on-premises Active Directory for console access, and to store the database password in AWS Secrets Manager with automatic rotation enabled.
Configuring AWS IAM Identity Center with on-premises Active Directory enables centralized federation and single sign-on (SSO), avoiding the administrative overhead and security risks of managing long-term IAM user credentials. Storing the database password in AWS Secrets Manager allows for secure storage and built-in, automated credential rotation every 30 days, which meets the security compliance requirements.
Step-by-Step Solution
Key Concept
Centralized identity federation and secure secrets management with automated rotation
Estimated Time:2m 0s