Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A financial services company is deploying an application on-premises that needs to periodically read and write files to an Amazon S3 bucket. The application must also retrieve credentials to connect to an Amazon RDS database and decrypt sensitive configuration files using an AWS KMS customer managed key. The company's security policy strictly prohibits the use of long-term AWS credentials and requires that all access be based on temporary security credentials. The company already has an established internal public key infrastructure (PKI). Which combination of actions should a solutions architect recommend?

  1. A
    Generate access keys for the AWS account root user and configure the application to use them to ensure uninterrupted access. Store the database credentials in AWS Secrets Manager, and configure AWS KMS to automatically rotate the customer managed key daily, which immediately re-encrypts all historical data.
  2. Configure AWS IAM Roles Anywhere to allow the on-premises application to assume an IAM role with the minimum required S3 and KMS permissions. Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the KMS customer managed key.Answer
  3. C
    Create a dedicated IAM user with administrative permissions for the application, generate long-term access keys, and store them in the application configuration. Store the database credentials in AWS Secrets Manager, and manually rotate the KMS customer managed key by creating a new key and immediately deleting the old key.
  4. D
    Create a dedicated IAM user for the application, generate long-term access keys, and configure the application to use them. Store the database credentials in AWS Systems Manager Parameter Store as a plaintext String parameter, and enable automatic annual rotation for the KMS customer managed key.

Answer

Configure AWS IAM Roles Anywhere to allow the on-premises application to assume an IAM role with the minimum required S3 and KMS permissions. Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the KMS customer managed key.
The correct solution uses AWS IAM Roles Anywhere to establish trust between the on-premises PKI and AWS IAM. This allows the on-premises application to assume an IAM role and obtain temporary credentials, avoiding long-term access keys. AWS Secrets Manager is the best practice for storing database credentials because it supports automatic rotation. Enabling automatic annual key rotation for the KMS key is the recommended key management practice.

Step-by-Step Solution

1
Establish a trust anchor in AWS IAM Roles Anywhere using the company's internal PKI Certificate Authority (CA) certificate.
AWS IAM Roles Anywhere can now authenticate the on-premises application based on its X.509 certificate.
To eliminate the need for long-term AWS credentials on the on-premises server.
2
Create an IAM role with a trust policy that allows the AWS IAM Roles Anywhere service principal to assume the role, and attach policies granting the required permissions for S3 and KMS.
The application can exchange its certificate for temporary security credentials corresponding to the role.
To enforce the principle of least privilege using short-lived credentials.
3
Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic key rotation for the customer managed key in AWS KMS.
Database credentials are rotated automatically without application downtime, and the KMS key is rotated annually without disabling the ability to decrypt historical data.
To satisfy the security requirements for secrets management and secure key lifecycle management.

Key Concept

AWS IAM Roles Anywhere and Secure Credentials Management
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic