Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A company has an on-premises reporting application that must query an Amazon RDS database and write output reports to an Amazon S3 bucket. The application requires database credentials that must be rotated every 30 days. The company's security policy prohibits the use of long-term AWS credentials on-premises and mandates that database passwords must not be stored in plaintext.

Which solution meets these security requirements?

  1. Configure IAM Roles Anywhere to allow the on-premises application to exchange its X.509 certificate for temporary AWS credentials with permissions to write to the S3 bucket. Store the database credentials in AWS Secrets Manager, configure automatic rotation every 30 days, and retrieve the credentials dynamically using the temporary session.Answer
  2. B
    Configure IAM Roles Anywhere to allow the on-premises application to exchange its X.509 certificate for temporary AWS credentials. Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store, and run an on-premises scheduled script to rotate the database password and update the parameter value in plaintext every 30 days.
  3. C
    Create an IAM user with a policy that allows writing to the S3 bucket. Generate long-term access keys for this IAM user, store them on the on-premises server, and store the database credentials in an encrypted local configuration file that is updated manually every 30 days.
  4. D
    Use the AWS account root user credentials to configure the AWS CLI on the on-premises server to ensure uninterrupted access. Store the database credentials in AWS Secrets Manager, enable automatic rotation every 30 days, and retrieve the database credentials using the root credentials.

Answer

The solution using IAM Roles Anywhere with X.509 certificates and AWS Secrets Manager with automatic rotation.
The correct solution uses IAM Roles Anywhere, which allows workloads outside of AWS (such as on-premises servers) to use local digital certificates (X.509) to obtain temporary AWS credentials, thus avoiding long-term IAM user access keys. It also uses AWS Secrets Manager, which securely encrypts secrets at rest and supports automatic rotation of database credentials out-of-the-box.

Step-by-Step Solution

1
Establish secure, temporary authentication for the on-premises application.
IAM Roles Anywhere exchanges the application's X.509 certificates issued by a trusted Certificate Authority (CA) for temporary, short-lived AWS IAM credentials.
This eliminates the need to store long-term AWS access keys on-premises, satisfying the corporate security policy.
2
Store and secure the RDS database connection credentials.
The database password is saved securely as an encrypted secret within AWS Secrets Manager.
Secrets Manager integrates with AWS KMS to encrypt the secret at rest and ensures passwords are not stored in plaintext.
3
Automate credential rotation.
Secrets Manager uses an AWS Lambda function to automatically rotate the database password and update both the database and the secret every 30 days.
This satisfies the requirement for 30-day automated rotation without requiring manual script maintenance or storing plaintext secrets.

Key Concept

Securing hybrid cloud access using IAM Roles Anywhere to provide temporary credentials to on-premises workloads, combined with AWS Secrets Manager for encrypted secret storage and automated rotation.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic