Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is designing a security baseline for its new multi-account AWS environment. The solution must address two requirements:
First, 500500 corporate identity directory users need single sign-on access to the AWS Management Console and CLI.
Second, a containerized application running on Amazon ECS needs to securely retrieve database credentials that must be rotated every 3030 days.
Which combination of actions should the solutions architect recommend to meet these requirements securely? (Select TWO.)

  1. Configure AWS IAM Identity Center to federate the company's identity provider and assign permissions using permission setsAnswer
  2. Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda functionAnswer
  3. C
    Create individual IAM users in the parent AWS account for each corporate user and configure access keys for CLI access
  4. D
    Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to simplify container retrieval
  5. E
    Use the AWS account root user credentials to establish the initial database connection and manage regular rotations

Answer

Configure AWS IAM Identity Center to federate the company's identity provider, and store the database credentials in AWS Secrets Manager with automatic rotation using an AWS Lambda function.
Centralizing access control through AWS IAM Identity Center provides federated single sign-on without the overhead and risk of long-term IAM users. For sensitive data like database credentials, AWS Secrets Manager securely stores the secret and automates its rotation using an AWS Lambda function, maintaining compliance with security standards.

Step-by-Step Solution

1
Address the single sign-on requirement for the 500500 users by configuring federation.
AWS IAM Identity Center is configured to connect to the external identity provider, enabling users to access AWS accounts with temporary credentials.
This avoids creating individual IAM users, complying with security best practices for identity management.
2
Address the secure credential storage and 3030-day rotation requirement.
AWS Secrets Manager is chosen to store the database credentials, and its built-in rotation feature is enabled with an AWS Lambda function running every 3030 days.
Secrets Manager provides native support for rotating database credentials automatically, which is not available as a native feature in Systems Manager Parameter Store without custom scripting, and is much more secure than storing credentials in plaintext.

Key Concept

Centralized identity federation using AWS IAM Identity Center and automated secrets management with AWS Secrets Manager.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic