Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is deploying a new application on Amazon EC2 instances in a private subnet. The application requires secure read-only access to an Amazon S3 bucket and must retrieve database passwords that are rotated monthly. The development team, who are federated from the company's on-premises Active Directory, also needs administrative access to manage the EC2 instances. The security architect must design a solution that enforces the principle of least privilege, avoids long-term credentials, and prevents credentials from being stored in plaintext. Which combination of actions will meet these requirements? (Select TWO.)

  1. Associate an IAM role with the EC2 instances via an instance profile to grant read-only access to the S3 bucket, and store the database passwords in AWS Secrets Manager with automatic rotation enabled.Answer
  2. Configure AWS IAM Identity Center and establish SAML 2.0 federation with the on-premises Active Directory to grant the development team temporary administrative access to the EC2 instances.Answer
  3. C
    Generate access keys for the AWS account root user and configure them on the EC2 instances to grant S3 access, and use the root account to manage EC2 administrative tasks.
  4. D
    Create individual IAM users with long-term credentials for each developer in the on-premises Active Directory to allow them to log in and perform administrative tasks on the EC2 instances.
  5. E
    Store the database passwords as plaintext String parameters in Systems Manager Parameter Store and write a custom script on the EC2 instances to retrieve them.

Answer

The application should use an IAM role associated via an instance profile to access the S3 bucket, and database passwords should be stored in AWS Secrets Manager with automatic rotation. The development team should access the AWS environment through federation configured with AWS IAM Identity Center.
The correct strategy combines IAM roles on EC2 instances for secure, service-to-service access with AWS Secrets Manager for encrypted, rotated secrets. For human access, federating the existing Active Directory with AWS IAM Identity Center provides short-lived temporary access, eliminating long-term credentials and centralized credential management.

Step-by-Step Solution

1
Address application authorization by creating an IAM role with read-only permissions for the S3 bucket and attaching it to the EC2 instances via an instance profile.
The application on EC2 can securely read from S3 using automatically rotated temporary security credentials.
Eliminates the need for hardcoded, long-term AWS credentials on the EC2 instances.
2
Store the database connection credentials in AWS Secrets Manager, configure automatic rotation with a custom or template-based AWS Lambda function, and grant the EC2 IAM role read permissions to the secret.
The application retrieves the current password securely at runtime, and the password is rotated monthly without developer intervention.
Meets compliance requirements for secure, automated rotation of database credentials without plaintext exposure.
3
Configure AWS IAM Identity Center to federate with the on-premises Active Directory using SAML 2.0 to grant the developers temporary administrative access.
Developers use single sign-on (SSO) to access the AWS Management Console or AWS CLI with short-lived sessions.
Supports the goal of using centralized identity management and avoiding the creation of local IAM users.

Key Concept

Applying least privilege, temporary security credentials via IAM roles/federation, and secure secrets management with automated rotation.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic