Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A company is migrating its deployment pipeline from a self-hosted server to GitHub Actions. The pipeline workflows must deploy serverless applications in a production AWS account and retrieve sensitive database credentials. The company's security policy requires that all database credentials be rotated automatically every 30 days and strictly prohibits storing long-term AWS credentials or plaintext secrets in external repositories.

Which combination of actions should a solutions architect recommend to meet these security requirements? (Select TWO.)

  1. A
    Create a dedicated IAM user with programmatic access for the deployment pipeline, generate long-term access keys, and store them as encrypted secrets in the GitHub repository.
  2. Configure an OpenID Connect (OIDC) identity provider in AWS IAM for GitHub, and create an IAM role with a trust policy that allows the `sts:AssumeRoleWithWebIdentity` action restricted to the specific GitHub repository.Answer
  3. C
    Store the database credentials as a String parameter in AWS Systems Manager Parameter Store, and configure the GitHub Actions workflow to retrieve the credentials using a custom deployment script.
  4. Store the database credentials in AWS Secrets Manager, configure automatic rotation every 30 days using an AWS Lambda function, and grant the IAM role permissions to retrieve the secret.Answer
  5. E
    Enable automatic key rotation for the AWS KMS Customer Managed Key used to encrypt the credentials, which will immediately re-encrypt all historical database credential versions under the new key version.

Answer

To securely integrate GitHub Actions and manage database credentials, configure an OpenID Connect (OIDC) identity provider in AWS IAM with an IAM role using web identity federation. Additionally, store the database credentials in AWS Secrets Manager and set up automatic 30-day rotation using an AWS Lambda function.
Establishing an OIDC identity provider in AWS IAM enables GitHub Actions workflows to request short-lived temporary security credentials using the `sts:AssumeRoleWithWebIdentity` action. This removes the need for storing long-term IAM user access keys in GitHub. Storing the database credentials in AWS Secrets Manager allows native integration with rotation schedules using Lambda functions to enforce the 30-day rotation policy.

Step-by-Step Solution

1
Configure an OpenID Connect (OIDC) identity provider for GitHub Actions in the IAM console.
Establishes a trust relationship between AWS and GitHub's Identity Provider.
Allows AWS to verify identity tokens issued by GitHub Actions.
2
Create an IAM role with a trust policy allowing the `sts:AssumeRoleWithWebIdentity` action, constrained to the specific GitHub organization and repository using condition keys.
Provides temporary security credentials for the GitHub runner without storing long-term credentials.
Enforces least privilege access and avoids credential exposure.
3
Store the database password as a secret in AWS Secrets Manager.
The secret is encrypted at rest using an AWS KMS Customer Managed Key.
Protects sensitive database credentials from being exposed in plaintext.
4
Enable automatic rotation in AWS Secrets Manager with a 30-day schedule using a rotation AWS Lambda function.
The Lambda function automatically rotates the database credentials in both the database and Secrets Manager.
Satisfies the regulatory requirement for automatic 30-day credential rotation.

Key Concept

Identity federation using OpenID Connect (OIDC) and automated secrets management with rotation.
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic