Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A company has an on-premises Active Directory and is migrating its web application to AWS. The application runs on Amazon EC2 instances. The solutions architect must ensure that:
1. Corporate employees can access the AWS Management Console using their existing credentials, without creating individual IAM users.
2. The EC2 instances can securely access a private Amazon S3 bucket without using long-term credentials.
3. Administrative operations in the AWS account must be restricted to standard IAM administrative roles, ensuring the root user is not used for daily activities.

Which combination of steps should the solutions architect implement to meet these security requirements?

  1. A
    Create individual IAM users for each employee and run a script to synchronize passwords from Active Directory. Store the S3 access keys in a plaintext String parameter in AWS Systems Manager Parameter Store for the EC2 instances to retrieve. Use the AWS account root user credentials for daily administrative tasks.
  2. B
    Configure AWS IAM Identity Center to federate the on-premises Active Directory. Generate a dedicated IAM user with long-term credentials, configure S3 access permissions on this user, and distribute the access keys to the EC2 instances. Enable automatic key rotation for the customer managed KMS key encrypting the S3 bucket, assuming it will immediately re-encrypt all existing bucket data.
  3. Configure AWS IAM Identity Center to federate the on-premises Active Directory. Attach an IAM role with an instance profile to the EC2 instances to grant temporary permissions to access the S3 bucket. Create a dedicated IAM role with administrative policies for daily cloud administration instead of using the AWS account root user.Answer
  4. D
    Create individual IAM users for each employee in the AWS account. Attach an IAM role with an instance profile to the EC2 instances to grant temporary permissions to access the S3 bucket. Configure the AWS account root user to perform daily administrative tasks, ensuring Multi-Factor Authentication (MFA) is enabled on the root user.

Answer

Configure AWS IAM Identity Center to federate the Active Directory, use an IAM role with an instance profile for EC2 S3 access, and use a dedicated administrative IAM role for daily tasks instead of the root user.
The correct solution uses AWS IAM Identity Center to federate Active Directory identities, which fulfills the requirement of single sign-on without manual IAM user overhead. It employs an IAM role with an instance profile to supply temporary credentials to EC2 instances, adhering to credential management best practices. Finally, it uses a dedicated administrative IAM role for daily tasks rather than exposing the root user account.

Step-by-Step Solution

1
Configure AWS IAM Identity Center to federate Active Directory.
Employees can log in with corporate credentials without creating duplicate IAM users in AWS.
Allows centralized identity management and avoids the creation of static IAM users.
2
Assign an IAM role with an instance profile to the EC2 instances.
The application automatically obtains temporary AWS security credentials to access S3.
Eliminates the risk of hardcoded, static credentials on the EC2 instances.
3
Deploy a dedicated IAM role for administrator duties.
Administrative operations are performed securely without using the AWS account root user.
Protects the root account by restricting daily administrative actions to standard IAM roles.

Key Concept

Identity Federation, IAM Roles, and Least Privilege Account Management
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic