Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is designing the access control mechanism for its development team. The developers need to access AWS resources to deploy applications. The security team mandates that developers must use their existing corporate directory credentials to log in, and no long-term AWS credentials should be stored on developer machines. Additionally, sensitive database credentials used by the applications must be stored securely and rotated automatically every 30 days. Which combination of AWS services and configurations should a solutions architect recommend to meet these requirements?

  1. Configure AWS IAM Identity Center to federate with the corporate directory, allowing developers to assume short-term IAM roles. Use AWS Secrets Manager to store the database credentials and configure automatic rotation.Answer
  2. B
    Create individual IAM users in the AWS account for each developer, generate long-term access keys for local development, and configure AWS Secrets Manager to store and rotate the database credentials.
  3. C
    Enable multi-factor authentication (MFA) on the AWS account root user, share the root login credentials with the lead developers for deployments, and store the database credentials as a SecureString parameter in Systems Manager Parameter Store.
  4. D
    Configure AWS IAM Identity Center to federate with the corporate directory. Store the database credentials as a plaintext String parameter in Systems Manager Parameter Store, and write a custom script to rotate the parameter.

Answer

Configure AWS IAM Identity Center to federate with the corporate directory, allowing developers to assume short-term IAM roles. Use AWS Secrets Manager to store the database credentials and configure automatic rotation.
The correct configuration uses AWS IAM Identity Center to federate with the corporate directory, allowing developers to authenticate with their existing credentials and assume short-term roles instead of using long-term credentials. Additionally, using AWS Secrets Manager to store and automatically rotate the database credentials satisfies the security policy for encrypting and rotating sensitive data.

Step-by-Step Solution

1
Address the federated access requirement by configuring AWS IAM Identity Center to integrate with the corporate directory, which enables single sign-on using corporate credentials without creating permanent IAM users.
Developers can authenticate using their existing corporate credentials and obtain short-term credentials via IAM roles.
This removes the need to store long-term access keys on developer machines, meeting the primary security constraint.
2
Address the sensitive database credentials requirement by storing them in AWS Secrets Manager.
Credentials are encrypted at rest and can be retrieved programmatically.
Secrets Manager provides native support for encrypting secrets and automatically rotating them using built-in integration with databases.

Key Concept

AWS identity federation using IAM Identity Center combined with secure secrets management using AWS Secrets Manager.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic