Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A solutions architect is designing a secure architecture for a web application. The application tier runs on Amazon EC2 instances and must access a database hosted on Amazon RDS. The database credentials must be encrypted at rest, and the security team requires that these credentials be rotated automatically every 30 days. In addition, the company's internal developers, who are authenticated via corporate Active Directory, need temporary administrative access to the AWS Management Console to manage the RDS instances. Which combination of actions will meet these requirements in the most secure manner?

  1. A
    Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Create individual IAM users with long-term access keys for each corporate developer.
  2. Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Configure AWS IAM Identity Center to federate corporate Active Directory users, allowing them to assume an administrative IAM role.Answer
  3. C
    Store the database credentials as plaintext parameters in Systems Manager Parameter Store. Attach an IAM role to the EC2 instances with permission to retrieve the parameters. Configure AWS IAM Identity Center to federate corporate Active Directory users, allowing them to assume an administrative IAM role.
  4. D
    Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Provide the corporate developers with the AWS account root user credentials to manage the RDS instances.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Configure AWS IAM Identity Center to federate corporate Active Directory users, allowing them to assume an administrative IAM role.
Storing database credentials in AWS Secrets Manager with automatic rotation ensures that credentials are encrypted at rest and rotated programmatically without application downtime. Attaching an IAM role to the EC2 instances allows them to securely access Secrets Manager using temporary security credentials rather than long-term credentials. Configuring AWS IAM Identity Center to federate corporate Active Directory users allows developers to sign in using their existing corporate credentials and assume an administrative IAM role with temporary credentials, aligning with the principle of least privilege and eliminating the overhead of managing long-term IAM user credentials.

Step-by-Step Solution

1
Store database credentials securely.
Store database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.
This encrypts the credentials at rest using AWS KMS and programmatically rotates them without manual intervention, satisfying database credentials security requirements.
2
Grant application access using IAM roles.
Attach an IAM role to the Amazon EC2 instances with a policy allowing access to the specific secret in AWS Secrets Manager.
This allows the application to dynamically retrieve database credentials using temporary security credentials instead of hardcoding credentials in code or configuration files.
3
Implement identity federation for administrative access.
Configure AWS IAM Identity Center integrated with the corporate Active Directory to allow corporate developers to log in and assume an administrative IAM role.
This eliminates the need to manage individual IAM users for federated corporate employees, ensuring administrative access is controlled, audited, and utilizes short-lived security tokens.

Key Concept

Implementing secure credential management with AWS Secrets Manager and administrative access federation with AWS IAM Identity Center.
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic