Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A company needs to grant daily administrative access to a team of solutions architects. The administrators will perform tasks such as launching Amazon EC2 instances and configuring Amazon S3 buckets. Additionally, the company needs to store database connection strings and passwords securely.

Which design choice represents the most secure approach for these requirements?

  1. A
    Use the AWS account root user credentials for daily administrative tasks, and store the database credentials in AWS Secrets Manager.
  2. B
    Create individual IAM users with long-term credentials for corporate employees who already authenticate via an external identity provider, and store the database credentials in AWS Secrets Manager.
  3. Configure individual IAM users or roles with policies granting least privilege for daily administrative tasks, and store the database credentials in AWS Secrets Manager.Answer
  4. D
    Configure individual IAM users or roles with policies granting least privilege for daily administrative tasks, and store the database credentials as plaintext parameters in Systems Manager Parameter Store.

Answer

Configure individual IAM users or roles with policies granting least privilege for daily administrative tasks, and store the database credentials in AWS Secrets Manager.
The correct configuration utilizes individual IAM identities (users or roles) adhering to the principle of least privilege, while leveraging AWS Secrets Manager to securely encrypt, store, and manage database credentials. This aligns with AWS security best practices.

Step-by-Step Solution

1
Evaluate the mechanism for administrative access, ensuring the root account is restricted to account-level actions only.
The root account should not be used, and standard administrative tasks should be executed via individual IAM users or roles.
This enforces the principle of least privilege and provides accountability for administrative actions.
2
Analyze the requirement for database credential storage, comparing secure storage options with plaintext parameters.
Sensitive credentials must be encrypted using Secrets Manager, rather than being stored in plaintext.
Plaintext parameters in Systems Manager Parameter Store expose credentials to unauthorized access.
3
Verify if federated access should be used over local IAM users.
If users authenticate via an external identity provider, identity federation is preferred over creating long-term IAM users.
This reduces administrative complexity and centralizes user lifecycle management.

Key Concept

AWS IAM Best Practices (least privilege, avoiding root accounts, and securing sensitive data)
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic