Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An application running on an Amazon EC2 instance in a development AWS account needs to securely access and read objects from an Amazon S3 bucket located in a separate production AWS account. The company's security policy strictly prohibits the use of long-term credentials and requires that all access logs identify the specific EC2 instance making the requests. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

  1. In the production account, create an IAM role with a trust policy that allows the development account's EC2 instance IAM role to assume it.Answer
  2. In the development account, attach an IAM policy to the EC2 instance's IAM role that grants the sts:AssumeRole permission for the production account's role.Answer
  3. C
    In the production account, configure the S3 bucket policy to grant read access to the root user of the development account.
  4. D
    In the development account, create an IAM user with API keys, and store the keys as plaintext parameters in Systems Manager Parameter Store.
  5. E
    In the development account, manually create individual IAM users with long-term credentials for the EC2 instances to access the production bucket.

Answer

To securely access the S3 bucket in a separate account without long-term credentials, create an IAM role in the production account that trusts the development EC2 instance role, and grant the EC2 instance role permission to assume that production role.
The correct solution involves setting up cross-account access using an IAM role. In the production account, an IAM role is created with a trust policy that allows the IAM role attached to the EC2 instance in the development account to assume it. In the development account, the EC2 instance role is granted permission to perform the sts:AssumeRole action on the production role. This approach ensures access is secure, temporary, and easily auditable.

Step-by-Step Solution

1
Configure the IAM role in the target production account.
An IAM role is created in the production account with a trust policy allowing the development EC2 instance's IAM role to assume it, along with a permissions policy granting read access to the specific S3 bucket.
This defines who is trusted to access the production resources and what actions they can perform once authorized.
2
Configure the IAM role in the source development account.
An IAM role is attached to the EC2 instance as an instance profile, and its policy is updated to allow the sts:AssumeRole action targeting the ARN of the IAM role in the production account.
This authorizes the EC2 instance to request temporary credentials by assuming the trusted role in the production account.
3
Assume the role from the EC2 instance.
The application running on the EC2 instance calls the AWS Security Token Service (STS) to assume the production IAM role, receiving short-lived temporary security credentials to access the S3 bucket.
This satisfies the security requirement to use temporary credentials instead of long-term keys.

Key Concept

Cross-account access using IAM roles and STS AssumeRole.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic