Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A financial services company needs to grant its application developers command-line access to manage resources in several AWS accounts. The developers work from local workstations. To comply with security policies, the company must prevent the storage of long-term access keys on local machines, require multi-factor authentication (MFA), and ensure that permissions are automatically revoked when a developer leaves the company. The company currently manages developer identities in an external identity provider (IdP). Which solution should a solutions architect recommend to meet these requirements?

  1. Configure AWS IAM Identity Center to federate with the external identity provider, and instruct developers to configure the AWS CLI using the SSO command to obtain temporary credentials.Answer
  2. B
    Create individual IAM users in each AWS account for the developers, generate long-term access keys, and configure the developers to store these credentials locally in their AWS CLI credentials file.
  3. C
    Store a shared IAM user's Access Key ID and Secret Access Key as plaintext String parameters in AWS Systems Manager Parameter Store, and have developers retrieve them programmatically when running CLI commands.
  4. D
    Share the AWS account root user credentials securely using an enterprise password manager, and enforce multi-factor authentication (MFA) on the root account for all developer CLI sessions.

Answer

Configure AWS IAM Identity Center to federate with the external identity provider, and instruct developers to configure the AWS CLI using the SSO command to obtain temporary credentials.
Configuring AWS IAM Identity Center to federate with the external identity provider is the recommended best practice. It enables single sign-on (SSO) and ensures that developer access is automatically revoked when their account is deactivated in the external identity provider. Using the AWS CLI integration with IAM Identity Center allows developers to authenticate and receive short-term credentials, eliminating the need to store long-term access keys on their local workstations.

Step-by-Step Solution

1
Identify the security requirements: eliminate long-term access keys on local machines, integrate with an external identity provider, and enforce MFA.
Limits options to federation and temporary credential mechanisms.
Long-term credentials stored locally present a significant security risk if a workstation is compromised.
2
Evaluate AWS IAM Identity Center federation.
IAM Identity Center integrates with external IdPs using SAML 2.0 or OIDC, allowing centralized management and automatic deprovisioning.
When a developer leaves the company, revoking their identity in the external IdP automatically revokes their access to AWS.
3
Determine the CLI configuration for IAM Identity Center.
The AWS CLI integration with IAM Identity Center dynamically requests short-term, temporary credentials, satisfying the local storage restriction.
Temporary credentials automatically expire, mitigating the risk of credential leakage.

Key Concept

Federated access and temporary credentials using AWS IAM Identity Center
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic