Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An enterprise has a legacy payroll application running on physical servers in an on-premises data center. The application must securely upload daily transaction logs to an Amazon S3 bucket. The company's security policy strictly prohibits the storage of long-term AWS credentials on physical on-premises servers. The company already maintains an internal Public Key Infrastructure (PKI) and a private Certificate Authority (CA). Which solution meets these security requirements with the least administrative overhead?

  1. A
    Create a dedicated IAM user with programmatic access, attach an IAM policy with S3 write permissions, and store the access keys on the on-premises server. Rotate the access keys manually every 9090 days.
  2. B
    Create an IAM user with programmatic access and store the access keys as plaintext String parameters in AWS Systems Manager Parameter Store. Configure the application to retrieve these keys at startup.
  3. Configure AWS IAM Roles Anywhere by defining a trust anchor linked to the internal Certificate Authority. Configure the application to exchange its X.509 digital certificate for temporary AWS credentials using an IAM role.Answer
  4. D
    Create access keys for the AWS account root user and configure the application to use these credentials. Implement an IAM policy to limit the root user's access to only the target Amazon S3 bucket.

Answer

Configure AWS IAM Roles Anywhere by defining a trust anchor linked to the internal Certificate Authority, and configure the application to exchange its X.509 digital certificate for temporary AWS credentials.
The correct solution involves configuring AWS IAM Roles Anywhere. Since the company already maintains a private Certificate Authority (CA), they can establish a trust anchor in IAM Roles Anywhere. The on-premises application can then use its X.509 digital certificate to authenticate and request short-lived, temporary AWS credentials from the AWS Security Token Service (STS) using an IAM role. This eliminates the need to store long-term AWS credentials on-premises, satisfying the security policy.

Step-by-Step Solution

1
Analyze the requirements for accessing the Amazon S3 bucket from an on-premises environment.
Identify that the application needs to upload logs to Amazon S3, but storing long-term credentials (like IAM access keys) on-premises is strictly prohibited.
This rules out solutions that rely on creating static IAM users and distributing access keys to physical servers.
2
Evaluate the available identity federation and credential management options.
Since the company has an established PKI with an internal Certificate Authority (CA), they can leverage AWS IAM Roles Anywhere.
AWS IAM Roles Anywhere uses X.509 digital certificates to establish trust between the on-premises environment and AWS, enabling workloads to obtain temporary credentials.
3
Select the option that conforms to security best practices and has the least administrative overhead.
Establishing a trust anchor with the CA and mapping certificates to an IAM role is the standard, secure pattern that avoids long-term credentials.
This satisfies the security policy without requiring complex custom identity brokering or storing keys in plain text.

Key Concept

AWS IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers, to use digital certificates to exchange for temporary AWS credentials, avoiding the risk of long-term credentials.
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic