Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is setting up an automated deployment pipeline. A third-party CI/CD platform hosted outside of AWS needs to deploy infrastructure changes to the company's AWS account. The company's security policy prohibits the use of long-term credentials for external integrations. Which combination of actions should a solutions architect perform to grant the CI/CD platform access to the AWS account? (Select TWO.)

  1. Configure an OpenID Connect (OIDC) identity provider in IAM that trusts the external CI/CD provider as the issuer.Answer
  2. B
    Create an IAM user with programmatic access keys, store these credentials in the CI/CD service's secrets settings, and write an AWS Lambda function to rotate the keys daily.
  3. C
    Create an IAM user for the CI/CD pipeline, and save the access key ID and secret access key as standard String parameters in AWS Systems Manager Parameter Store to allow external retrieval.
  4. Create an IAM role with a trust policy that allows the external CI/CD provider's OIDC identity provider to assume the role using the sts:AssumeRoleWithWebIdentity action.Answer
  5. E
    Generate access keys for the AWS account root user and store them in the external CI/CD platform's repository secrets to ensure administrative deployment privileges.

Answer

To grant secure access without long-term credentials, configure an OpenID Connect (OIDC) identity provider in IAM that trusts the external CI/CD provider as the issuer, and create an IAM role with a trust policy that allows the external OIDC provider to assume the role using the sts:AssumeRoleWithWebIdentity action.
To grant secure access without long-term credentials, the architect should use OpenID Connect (OIDC) identity federation. First, configuring an OpenID Connect (OIDC) identity provider in IAM establishes a trust relationship between AWS and the external CI/CD platform. Second, creating an IAM role with a trust policy that allows the external OIDC provider to assume the role using the sts:AssumeRoleWithWebIdentity action enables the CI/CD pipeline to exchange OIDC tokens for short-lived, temporary AWS credentials.

Step-by-Step Solution

1
Establish trust with the external provider.
An OpenID Connect (OIDC) identity provider (IdP) is registered in the company's AWS account, trusting the external CI/CD platform as the token issuer.
This allows AWS to validate authentication tokens issued by the external CI/CD provider without needing long-term AWS access keys.
2
Create an IAM role for authorization.
An IAM role is created with a trust policy allowing the OIDC provider to assume it via the sts:AssumeRoleWithWebIdentity action, and permissions are attached to it.
This grants temporary credentials to the external provider specifically during pipeline runs, adhering to the principle of least privilege.

Key Concept

OpenID Connect (OIDC) Federation for temporary AWS credentials
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic