Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An enterprise is migrating its legacy inventory system to a multi-account AWS environment. A legacy application running on-premises must write daily inventory reports directly to an Amazon S3 bucket located in a centralized AWS account. The company's security policy strictly prohibits the storage of long-term AWS security credentials on-premises. Which solution meets these requirements with the least operational overhead?

  1. A
    Create an AWS Systems Manager Parameter Store parameter of type String containing static AWS credentials, and configure the on-premises application to retrieve them using the AWS CLI at startup.
  2. B
    Create a dedicated IAM user in the AWS account, generate access keys, and configure the on-premises application to use these credentials stored in a local configuration file.
  3. Implement AWS IAM Roles Anywhere. Configure a trust anchor with the on-premises Certificate Authority (CA), define an IAM role with permissions to write to the S3 bucket, and exchange X.509 certificates for temporary AWS credentials.Answer
  4. D
    Generate an access key for the AWS account root user, and configure the on-premises application to use these credentials to ensure the application has administrative rights to write to any bucket.

Answer

Implement AWS IAM Roles Anywhere by establishing a trust anchor with the on-premises Certificate Authority (CA), defining an IAM role, and exchanging X.509 certificates for temporary AWS credentials.
The solution that configures AWS IAM Roles Anywhere is correct because it uses X.509 digital certificates from an on-premises Certificate Authority to authenticate and retrieve temporary, short-lived credentials. This avoids the security risk of storing long-term credentials on physical on-premises servers.

Step-by-Step Solution

1
Analyze the security constraints.
The application is on-premises and must access AWS resources (Amazon S3), but the local storage of long-term AWS credentials (like IAM access keys) is forbidden.
To identify which mechanism can provide secure, short-lived credentials for non-AWS workloads.
2
Evaluate AWS credential provisioning options for on-premises workloads.
AWS IAM Roles Anywhere allows non-AWS workloads to use local digital certificates (X.509) to obtain temporary security credentials via IAM roles.
IAM Roles Anywhere is the native AWS service designed specifically to eliminate long-term credentials for workloads running outside of AWS.
3
Define the implementation details.
Create a trust anchor linked to the internal CA, define a role with S3 write access, and configure the application to request temporary session credentials using the certificate.
This establishes a cryptographic trust chain between the local infrastructure and AWS without introducing static credentials.

Key Concept

Exchanging X.509 certificates for short-lived credentials via AWS IAM Roles Anywhere
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic