Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company has on-premises servers that need to securely upload log files to an Amazon S3 bucket. The company's security policy strictly prohibits the storage or use of long-term AWS security credentials, such as IAM user access keys, on the on-premises servers. A solutions architect must design an authorization solution that enables these servers to dynamically request temporary AWS security credentials.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a trust anchor in AWS IAM Roles Anywhere by establishing trust with a supported private or public Certificate Authority (CA).Answer
  2. Install and configure the AWS IAM Roles Anywhere credential helper tool on the on-premises servers to retrieve credentials from AWS Security Token Service (STS).Answer
  3. C
    Generate IAM access keys for the AWS account root user, and configure annual rotation of the root user keys using AWS KMS customer managed keys.
  4. D
    Store the IAM user access keys as plain text parameters in AWS Systems Manager Parameter Store so the servers can fetch them via simple API calls.
  5. E
    Manually create individual IAM users with long-term security credentials for the on-premises servers to authenticate via IAM identity federation.

Answer

The solutions architect should create a trust anchor in AWS IAM Roles Anywhere by establishing trust with a supported Certificate Authority (CA), and install and configure the AWS IAM Roles Anywhere credential helper tool on the on-premises servers to retrieve credentials from AWS Security Token Service (STS).
To secure communications from on-premises workloads without managing long-term AWS credentials, AWS IAM Roles Anywhere is the recommended service. Implementing this requires creating a trust anchor in AWS IAM Roles Anywhere linked to a Certificate Authority (CA) and running the IAM Roles Anywhere credential helper on the server to handle certificate exchange for temporary security credentials.

Step-by-Step Solution

1
Identify the service suited for assigning temporary AWS credentials to workloads running outside of AWS.
AWS IAM Roles Anywhere is identified as the correct service to establish trust and issue temporary credentials using X.509 digital certificates.
The security policy forbids long-term credentials, meaning standard IAM user access keys cannot be used on-premises.
2
Establish the root of trust on the AWS side.
Create a trust anchor in AWS IAM Roles Anywhere that points to the organization's existing Certificate Authority (CA) or AWS Private CA.
A trust anchor defines the CA that IAM Roles Anywhere trusts to sign client certificates presented by the servers.
3
Configure the client-side authentication on the on-premises servers.
Deploy the IAM Roles Anywhere credential helper on the servers to manage certificate-based requests to the AWS Security Token Service (STS) endpoint.
The credential helper integrates with the AWS CLI and SDKs, handling the signature generation and credential retrieval transparently without hardcoding keys.

Key Concept

AWS IAM Roles Anywhere allows workloads outside of AWS (like physical or virtual servers on-premises) to use X.509 certificates to obtain temporary AWS security credentials, removing the need to manage long-term IAM access keys.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic