Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is migrating its on-premises web application to AWS. The application will run on Amazon ECS containers. The solutions architect must design a security strategy to grant database administrators (DBAs) administrative access to the Amazon RDS DB instances using their existing corporate identity provider (IdP). Furthermore, the ECS application containers must securely access the database credentials, which must be rotated every 30 days without hardcoding them in the application or storing them in plaintext.

Which combination of actions should the solutions architect take to meet these security requirements?

  1. Configure AWS IAM Identity Center to federate the corporate identity provider, granting DBAs federated access to manage RDS. Store the database credentials in AWS Secrets Manager, enable automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.Answer
  2. B
    Create individual IAM users for each DBA in the AWS account, configure long-term credentials for AWS Management Console access, and manually synchronize their passwords with the corporate identity provider. Store the database credentials in AWS Secrets Manager with automatic 30-day rotation.
  3. C
    Configure AWS IAM Identity Center to federate the corporate identity provider for DBA access. Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to avoid KMS encryption overhead, and reference the parameter in the ECS task definition.
  4. D
    Instruct DBAs to use the AWS account root user credentials to perform administrative database tasks to ensure uninterrupted access. Store the database credentials in AWS Secrets Manager, and rely on AWS KMS automatic key rotation to automatically update the database password.

Answer

Configure AWS IAM Identity Center to federate the corporate identity provider for DBA access, store the database credentials in AWS Secrets Manager with automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.
The correct solution integrates AWS IAM Identity Center with the existing corporate identity provider to handle DBA access securely without creating long-term IAM users. It also utilizes AWS Secrets Manager to encrypt, store, and automatically rotate database credentials every 30 days, while using the ECS task execution role to dynamically retrieve the secret at runtime.

Step-by-Step Solution

1
Integrate the corporate identity provider with AWS IAM Identity Center.
Database administrators can log in to the AWS Management Console using their existing corporate credentials, eliminating the need to manage individual IAM users with long-term keys.
Aligns with the principle of least privilege and simplifies identity management via single sign-on.
2
Store the database credentials in AWS Secrets Manager.
The sensitive database password is encrypted at rest and stored securely.
Allows AWS Secrets Manager to manage the lifecycle of the credentials, preventing exposure in plaintext parameter store parameters or container images.
3
Configure AWS Secrets Manager to automatically rotate the secret every 30 days and update the Amazon RDS database.
Automatic rotation of the password is handled natively by AWS Secrets Manager via an integration with Amazon RDS.
Meets the security requirement for monthly credential rotation without manual intervention or custom script scheduling.
4
Grant retrieval permissions to the ECS task execution role and inject the secret into the container task definition.
The application container retrieves the credentials at startup without hardcoding the password in the image or exposing it in task environment variables.
Ensures secure, runtime access to the database credentials using IAM role-based authorization.

Key Concept

Centralized identity federation and secure, automated secrets management
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic