Design Secure Architectures

438 questions

All types438 Multiple choice214 Multiple select224

An enterprise is designing a secure multi-account environment to support multiple business units. The architecture must enforce centralized administrative control, federated access, and strict data protection policies. Specifically, the Solutions Architect must ensure that member accounts cannot delete Amazon S3 buckets containing centralized audit logs, and that employees authenticate using their corporate credentials to access designated AWS accounts.

Which combination of actions should the Solutions Architect recommend to achieve these goals? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center and integrate it with the enterprise identity provider to federate user access.

Attach a service control policy (SCP) to the member account organizational units (OUs) that denies the s3:DeleteBucket and s3:DeleteObject actions on the centralized audit log buckets.

Create individual IAM users in each member account and configure cross-account roles with trust policies linked directly to the enterprise identity provider.

Apply a service control policy (SCP) at the Organization root level that restricts the management account root user from performing deletion actions on the log buckets.

Configure each member account's root user credentials to run a scheduled AWS Lambda function that periodically audits and restores deleted S3 log buckets.

Show answer & explanation

Answer: Configure AWS IAM Identity Center and integrate it with the enterprise identity provider to federate user access.; Attach a service control policy (SCP) to the member account organizational units (OUs) that denies the s3:DeleteBucket and s3:DeleteObject actions on the centralized audit log buckets.

Answer

To establish secure multi-account governance, configure AWS IAM Identity Center integrated with the enterprise identity provider to federate user access, and apply a service control policy (SCP) to the member account organizational units (OUs) to deny bucket and object deletion actions on the centralized audit log buckets.

Centralizing access control through AWS IAM Identity Center integrated with the corporate identity provider ensures safe, federated access without the need for manual credential management. Applying a service control policy (SCP) to the member account OUs establishes a strong security guardrail, preventing anyone—including local administrators—from deleting critical audit log resources.

Step-by-Step Solution

Set up centralized federation.

Connect AWS IAM Identity Center to the corporate identity provider (IdP).

Allows employees to authenticate using existing corporate credentials and access their assigned AWS accounts dynamically via role assumption, avoiding the creation of static, local IAM users.

Enforce data protection via Organizations.

Create a service control policy (SCP) with a Deny effect for s3:DeleteBucket and s3:DeleteObject actions targeting the audit log buckets, and attach it to the OUs containing the member accounts.

SCPs act as permission guardrails that override local administrator permissions in member accounts, ensuring that log deletion is blocked across all target accounts.

Key Concept

Multi-account governance through AWS Organizations service control policies (SCPs) and centralized identity federation using AWS IAM Identity Center.

Estimated Time:2m 30s

Question 262Question →

An enterprise wants to allow a third-party SaaS monitoring application to collect performance metrics from Amazon CloudWatch in their AWS account. The SaaS provider's application runs in its own AWS account. The solutions architect must configure this access securely following the principle of least privilege, preventing unauthorized access by other customers of the SaaS provider.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create an IAM role in the enterprise account with a trust policy that trusts the SaaS provider's AWS account and requires a unique External ID

Attach a permissions policy to the IAM role that grants read-only access to Amazon CloudWatch metrics

Create an IAM user in the enterprise account, assign CloudWatch read-only permissions, and share the user's access keys with the SaaS provider

Share the enterprise account's root user access keys with the SaaS provider to ensure unrestricted access to all metrics

Store the API tokens and credentials used by the SaaS agent as a plaintext parameter in AWS Systems Manager Parameter Store

Show answer & explanation

Answer: Create an IAM role in the enterprise account with a trust policy that trusts the SaaS provider's AWS account and requires a unique External ID; Attach a permissions policy to the IAM role that grants read-only access to Amazon CloudWatch metrics

Answer

To securely grant access to the third-party SaaS monitoring application, the solutions architect should create an IAM role in the enterprise account with a trust policy that requires a unique External ID and trusts the SaaS provider's AWS account. Additionally, a permissions policy granting read-only access to Amazon CloudWatch metrics must be attached to this role.

The correct combination of steps involves creating an IAM role in the enterprise account that trusts the third-party's AWS account and enforces an External ID, and then attaching a CloudWatch read-only permissions policy to that role. This enables secure cross-account delegation of access without using long-term credentials and prevents the confused deputy security vulnerability.

Step-by-Step Solution

Identify the correct cross-account access mechanism.

Determine that an IAM role with cross-account access is preferred over long-term credentials.

Using roles eliminates the need to manage and share long-term credentials like access keys.

Secure the trust relationship for the role.

Specify the third party's AWS account ID in the trust policy and require a unique External ID.

The External ID mitigates the confused deputy problem when a third party accesses multiple customer accounts.

Apply the principle of least privilege.

Attach a permissions policy to the IAM role that only allows read-only access to CloudWatch metrics.

This ensures that the monitoring application can only access the metrics it needs and cannot perform administrative changes.

Key Concept

Cross-account access using IAM roles and External IDs to secure third-party integration.

Question 263Question →

A multinational corporation is implementing a centralized deployment pipeline. A containerized microservice hosted on Amazon ECS in a Shared Services account (Account ID: $888888888888$ ) must dynamically retrieve runtime secrets and database credentials from AWS Secrets Manager located in a Production database account (Account ID: $999999999999$ ). The Secrets Manager secret is encrypted using a Customer Managed Key (CMK) in the Production database account. The container in Account $888888888888$ runs under an IAM task role named `EcsSharedTaskRole`. The architecture must enforce the principle of least privilege and prevent the storage of long-term credentials.

Which combination of configuration steps is required to securely enable this cross-account retrieval? (Select TWO.)

Select all that apply

Attach an identity-based policy to `EcsSharedTaskRole` in Account

888888888888

that allows `secretsmanager:GetSecretValue` on the Production secret ARN and `kms:Decrypt` on the Customer Managed Key ARN. Update the secret's resource-based policy in Account

999999999999

to grant `secretsmanager:GetSecretValue` to the `EcsSharedTaskRole` ARN.

Configure the key policy of the Customer Managed Key in Account

999999999999

to grant `kms:Decrypt` permissions to `arn:aws:iam::888888888888:role/EcsSharedTaskRole`.

Create a dedicated IAM user in Account

999999999999

with a permission policy allowing secrets retrieval, generate long-term access keys, and configure the ECS task definition to pass these keys as environment variables to the container.

Replicate the secret values into the Systems Manager Parameter Store in Account

888888888888

as standard, unencrypted parameters to eliminate the need for cross-account KMS decryption and IAM task role configuration.

Configure the ECS task to run using the AWS account root user credentials of Account

888888888888

, and update the KMS key policy in Account

999999999999

to trust the root user of Account

888888888888

for all actions.

Show answer & explanation

Answer: Attach an identity-based policy to `EcsSharedTaskRole` in Account $888888888888$ that allows `secretsmanager:GetSecretValue` on the Production secret ARN and `kms:Decrypt` on the Customer Managed Key ARN. Update the secret's resource-based policy in Account $999999999999$ to grant `secretsmanager:GetSecretValue` to the `EcsSharedTaskRole` ARN.; Configure the key policy of the Customer Managed Key in Account $999999999999$ to grant `kms:Decrypt` permissions to `arn:aws:iam::888888888888:role/EcsSharedTaskRole`.

Answer

The correct configuration requires attaching an identity-based policy to the task role that allows secrets retrieval and decryption, granting the task role access in the secret's resource policy, and updating the KMS key policy to permit decryption by the task role.

To establish secure cross-account access to an encrypted secret in Secrets Manager, you must grant permissions on both sides of the account boundary. First, the IAM identity (the task role) in the consuming account must have an identity-based policy that allows accessing the secret and using the KMS key. Second, the secret's resource-based policy must explicitly permit the consuming role. Third, the KMS key policy in the producing account must trust the consuming role to perform decrypt operations. This direct delegation configuration satisfies the principle of least privilege.

Step-by-Step Solution

Configure identity-based permissions in the source account

The ECS task role has the necessary permissions to call cross-account APIs.

Before an IAM identity can access a resource in another account, it must be explicitly permitted by its own identity-based policy.

Configure the resource-based policy on the target secret

Secrets Manager permits the cross-account role to retrieve the secret value.

Cross-account access requires permission from the resource owner; the resource-based policy must explicitly list the external IAM role as an allowed principal.

Configure the KMS key policy on the Customer Managed Key

The external IAM role is allowed to decrypt the data key used to encrypt the secret payload.

Since the secret is encrypted with a Customer Managed Key, the key policy must trust the cross-account role principal. Identity-based policies alone cannot grant access to cross-account KMS keys without key policy cooperation.

Key Concept

Cross-account access delegation using IAM roles, resource-based policies, and KMS key policies under the principle of least privilege.

Question 264Question →

A company is designing a secure architecture for a reporting application that runs on Amazon EC2 instances in a private subnet. The application must retrieve a database password that is updated every 30 days. Additionally, developers who are managed in an external corporate directory need administrative access to manage these EC2 instances. The company's security policy prohibits the use of long-term credentials or hardcoded secrets.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center to federate the external directory, allowing developers to access AWS using temporary credentials associated with an administrative role.

Attach an IAM role to the EC2 instances using an instance profile, and configure the application to retrieve the database password dynamically from AWS Secrets Manager.

Create individual IAM users with long-term access keys for each developer in the AWS account, allowing them to authenticate directly.

Use the AWS account root user access keys on the EC2 instances to ensure administrative permissions are available for standard tasks.

Store the database password as a plaintext String parameter in Systems Manager Parameter Store, and enable AWS KMS key rotation to automatically update the password value.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the external directory, allowing developers to access AWS using temporary credentials associated with an administrative role.; Attach an IAM role to the EC2 instances using an instance profile, and configure the application to retrieve the database password dynamically from AWS Secrets Manager.

Answer

The solutions architect should recommend configuring AWS IAM Identity Center for directory federation and using an IAM role on the EC2 instances alongside AWS Secrets Manager for database password retrieval.

Configuring AWS IAM Identity Center enables secure, centralized identity federation with the external corporate directory, providing developers with short-term credentials via IAM roles. Associating an IAM role with the EC2 instances allows them to assume permissions securely without embedded credentials, and AWS Secrets Manager securely stores and automatically rotates the database password.

Step-by-Step Solution

Configure identity federation for developer access.

Developers use temporary credentials via AWS IAM Identity Center.

Secures access for external directory users without the need for long-term IAM access keys.

Configure EC2 instance profiles and IAM roles.

The application on the EC2 instances automatically receives temporary security credentials.

Eliminates the need to store hardcoded AWS credentials on the instances.

Store sensitive database credentials in AWS Secrets Manager.

Secrets are encrypted at rest and can be rotated automatically every 30 days.

Secures the database password and meets the rotation requirement seamlessly.

Key Concept

IAM role-based access, identity federation, and secure secrets management.

Question 265Question →

A digital media platform hosts its streaming content delivery application on Amazon EC2 instances within a private subnet. The security team needs to implement a solution to monitor the environment for active threats, such as EC2 instances communicating with known command-and-control (C2) servers or performing brute-force attacks. The solution must require minimal operational overhead and provide automatic alerting. Which configuration will meet these requirements?

Deploy AWS WAF at the subnet level to inspect all inbound and outbound traffic for Layer 7 exploits and malicious IP addresses, and trigger alerts using Amazon CloudWatch alarms.

Configure stateless Network ACLs at the subnet level to track stateful outbound connections to command-and-control servers, and use AWS Config to automatically block unauthorized traffic.

Enable Amazon GuardDuty to automatically analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs, and configure an Amazon EventBridge rule to route high-severity findings to an Amazon SNS topic for alerting.

Enable AWS Shield Standard to monitor all EC2 instance network interfaces for Layer 7 command-and-control communications, and configure security groups to block the traffic.

Show answer & explanation

Answer: Enable Amazon GuardDuty to automatically analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs, and configure an Amazon EventBridge rule to route high-severity findings to an Amazon SNS topic for alerting.

Answer

The correct solution uses Amazon GuardDuty, which is a managed threat detection service. It continuously analyzes data sources such as VPC Flow Logs, DNS logs, and CloudTrail management events using machine learning, anomaly detection, and integrated threat intelligence to detect malicious behavior (such as command-and-control communications or brute-force attacks) with minimal operational overhead. Integrating GuardDuty with Amazon EventBridge and Amazon SNS allows the security team to receive automatic alerts for high-severity findings.

Step-by-Step Solution

Enable Amazon GuardDuty in the target AWS account.

Amazon GuardDuty immediately begins consuming and analyzing logs including VPC Flow Logs, CloudTrail management events, and DNS query logs without impacting the performance of running EC2 instances.

This establishes the core detection mechanism that leverages built-in threat intelligence and machine learning to identify indicators of compromise, such as command-and-control communications.

Configure an Amazon EventBridge rule filtered for GuardDuty findings.

EventBridge detects when a new threat finding is generated by GuardDuty and matches it against the specified filter pattern (e.g., severity level is high).

This provides a serverless event-routing mechanism to automate response workflows.

Set the target of the EventBridge rule to an Amazon Simple Notification Service (SNS) topic.

The SNS topic triggers notifications (such as emails or SMS) to the security team upon receiving the matched event from EventBridge.

This completes the automated alerting pipeline with minimal custom code or infrastructure maintenance.

Key Concept

Continuous threat detection and automated alerting using managed security services

Question 266Question →

A company wants to allow external development contractors to deploy application resources in a development AWS account. The contractors manage their users in an external identity provider (IdP) that supports SAML 2.0. The security team requires that the contractors only be able to create IAM roles for their applications that do not exceed a specific security baseline. The contractors must not be able to escalate their own permissions or create roles that grant access to unauthorized services. Which TWO options should a solutions architect combine to meet these requirements securely? (Select TWO.)

Select all that apply

Configure SAML 2.0 identity federation to map the contractors' external identity provider groups to an IAM role in the AWS account, allowing them to assume the role.

Create an IAM policy for the contractor role that grants permission to create roles only if the role is created with a specific IAM permissions boundary policy attached, using the iam:PermissionsBoundary condition key.

Create individual IAM users in the AWS account for each contractor and generate long-term access keys for them to authenticate via the AWS CLI.

Share the AWS account root user credentials with the contractors securely through AWS Secrets Manager to perform role creation tasks.

Store the API access key and secret key of a highly privileged administrative user as a plaintext string in Systems Manager Parameter Store for the contractors' deployment tools to retrieve.

Show answer & explanation

Answer: Configure SAML 2.0 identity federation to map the contractors' external identity provider groups to an IAM role in the AWS account, allowing them to assume the role.; Create an IAM policy for the contractor role that grants permission to create roles only if the role is created with a specific IAM permissions boundary policy attached, using the iam:PermissionsBoundary condition key.

Answer

Configure SAML 2.0 identity federation to map the external IdP groups to an IAM role, and use an IAM permissions boundary policy enforced via the iam:PermissionsBoundary condition key on the contractor role's permissions.

The correct options implement a secure, best-practice architecture. By configuring SAML 2.0 federation, the company avoids creating long-term IAM credentials for external contractors. Enforcing a permissions boundary via the iam:PermissionsBoundary condition key prevents the contractors from creating roles that exceed the baseline policy or escalating their own permissions.

Step-by-Step Solution

Establish secure federated access for external contractors.

Contractors authenticate using their existing external Identity Provider (IdP) via SAML 2.0, assuming a temporary session role in AWS instead of using long-term IAM user credentials.

Aligns with the principle of least privilege and eliminates the risk associated with managing and rotating static credentials.

Define the security baseline using an IAM permissions boundary policy.

An IAM permissions boundary policy is created that lists the maximum allowed actions (e.g., S3 and DynamoDB access).

This policy does not grant permissions by itself, but defines the maximum privilege limit for any role to which it is applied.

Enforce the boundary policy on the contractors' role creation actions.

An IAM policy attached to the contractors' assumed role allows the iam:CreateRole action only when accompanied by the iam:PermissionsBoundary condition key referencing the baseline boundary policy ARN.

Prevents contractors from creating roles with elevated privileges, effectively blocking privilege escalation.

Key Concept

Delegating role creation securely using SAML 2.0 federation and IAM Permissions Boundaries to prevent privilege escalation.

Estimated Time:2m 30s

Question 267Question →

A company is designing a secure web application that will run on Amazon EC2 instances in a private subnet. The application needs to retrieve database credentials and encrypt sensitive files before storing them in an Amazon S3 bucket. The security policy mandates that database credentials must be rotated every 30 days, the encryption keys must be rotated annually, and the EC2 instances must access these resources securely using temporary credentials. Which TWO actions should the solutions architect take to meet these requirements?

Select all that apply

Create an IAM role with permissions to retrieve the credentials and decrypt with the AWS KMS key, associate the role with an EC2 instance profile, and attach it to the EC2 instances.

Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the customer managed KMS key.

Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store, and write a custom script to rotate the parameter.

Use the AWS account root user access keys stored locally on the EC2 instances to perform standard application decryption and database connection tasks.

Configure the customer managed KMS key to immediately re-encrypt all historical S3 data under the new key version when a rotation occurs.

Show answer & explanation

Answer: Create an IAM role with permissions to retrieve the credentials and decrypt with the AWS KMS key, associate the role with an EC2 instance profile, and attach it to the EC2 instances.; Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the customer managed KMS key.

Answer

To meet the security requirements, the solutions architect should store the database credentials in AWS Secrets Manager with automatic rotation, enable annual key rotation for the customer managed KMS key, and use an IAM role associated with an EC2 instance profile to grant the EC2 instances secure access to those resources.

The correct solution involves storing the credentials in AWS Secrets Manager and enabling automatic 30-day rotation, enabling automatic annual key rotation for the customer managed KMS key, and creating an IAM role attached to an EC2 instance profile to provide temporary credentials to the instances. This configuration ensures credentials and keys are rotated securely, and the EC2 instances access resources without hardcoded credentials.

Step-by-Step Solution

Configure secure credential management and key rotation.

Store the database credentials in Secrets Manager with a 30-day rotation schedule, and enable automatic annual rotation on the KMS key.

This satisfies the operational requirement to periodically rotate secrets and keys automatically.

Provide secure access to EC2 instances using IAM roles.

Create an IAM role with policy permissions to retrieve the secret and decrypt using the KMS key, associate it with an instance profile, and attach it to the EC2 instances.

This allows the application to authenticate using temporary security credentials rather than hardcoded long-term credentials.

Key Concept

Secure credential management, encryption key rotation, and IAM role association for EC2 instances.

Estimated Time:2m 0s

Question 268Question →

A company needs to grant temporary access to an Amazon S3 bucket in its AWS production account to external, third-party contractors. The contractors authenticate through an external OpenID Connect (OIDC) compliant identity provider and do not have their own AWS accounts. The company's security policy strictly prohibits the use of long-term credentials for external access. Which combination of actions should a solutions architect recommend to configure this access securely? (Select TWO.)

Select all that apply

Create an IAM identity provider for the OIDC-compliant identity provider in the AWS account.

Create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action, and attach an IAM policy that allows read and write permissions to the target S3 bucket.

Create individual IAM users in the production account for each contractor, configure multi-factor authentication (MFA), and distribute long-term access keys to them.

Enable access keys for the AWS account root user, and configure a trust policy on the root user to delegate access to the external contractors.

Store a set of long-term IAM access keys as plaintext parameters in Systems Manager Parameter Store, and grant the contractors access to read these parameters.

Show answer & explanation

Answer: Create an IAM identity provider for the OIDC-compliant identity provider in the AWS account.; Create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action, and attach an IAM policy that allows read and write permissions to the target S3 bucket.

Answer

Establish trust with the external OpenID Connect (OIDC) identity provider by creating an IAM identity provider, and configure an IAM role with a trust policy that permits the sts:AssumeRoleWithWebIdentity action combined with an S3 access policy.

The correct solution involves configuring web identity federation. By creating an IAM identity provider for the OIDC-compliant IdP, AWS can validate external tokens. Creating an IAM role that allows the 'sts:AssumeRoleWithWebIdentity' action in its trust policy enables the external contractors to dynamically exchange their OIDC token for temporary AWS security credentials, conforming to the least privilege principle and the requirement to avoid long-term credentials.

Step-by-Step Solution

Trust is established between AWS and the OIDC-compliant provider.

This allows AWS to recognize and validate OIDC authentication tokens presented by the contractors.

Create an IAM role with a trust policy that specifies the OIDC identity provider as the principal.

The role can be assumed by external users via the web identity token exchange.

The trust policy must permit the action 'sts:AssumeRoleWithWebIdentity' to allow the OIDC provider's users to trade identity tokens for temporary AWS security credentials.

Attach a policy to the IAM role that grants permissions to the specific S3 bucket.

Temporary credentials obtained from assuming the role only possess read and write access to the targeted S3 bucket.

This enforces the principle of least privilege by scoping the temporary credentials to only the necessary resources.

Key Concept

Web Identity Federation (OIDC) and IAM Roles

Question 269Question →

A company is deploying a containerized application on Amazon EC2 instances. The application requires access to an Amazon DynamoDB table to retrieve configuration settings. The developer proposes creating a new IAM user, generating long-term access keys, and embedding them in the application's configuration file. Which solution should a solutions architect recommend to establish secure access while adhering to the principle of least privilege?

Create an IAM role with a permissions policy that allows access to the DynamoDB table, attach this role to the EC2 instances using an instance profile, and configure the application to use the AWS SDK to retrieve temporary credentials automatically.

Create an IAM user with the required DynamoDB permissions, store the access keys in Systems Manager Parameter Store as a plaintext String parameter, and configure the application to retrieve these credentials at startup.

Create a standard String parameter in Systems Manager Parameter Store containing the AWS account root user's access keys, and configure the EC2 instances to retrieve these credentials at startup.

Create individual IAM users for each EC2 instance, and configure a SAML 2.0 identity provider to dynamically federate these user credentials for database access.

Show answer & explanation

Answer: Create an IAM role with a permissions policy that allows access to the DynamoDB table, attach this role to the EC2 instances using an instance profile, and configure the application to use the AWS SDK to retrieve temporary credentials automatically.

Answer

The correct solution uses an IAM role attached to the EC2 instances via an instance profile. This is the recommended security best practice because it eliminates the need to manage, store, or rotate long-term AWS credentials. The AWS SDK running inside the EC2 instances automatically retrieves temporary security credentials from the Instance Metadata Service (IMDS) to perform the authorized actions on DynamoDB.

Step-by-Step Solution

Define an IAM policy outlining the least privilege permissions required to access the target DynamoDB table.

An IAM policy document specifying permissions for DynamoDB actions.

Ensures the application has only the necessary access permissions.

Create an IAM role and attach the DynamoDB permissions policy to it.

An IAM role configured with the specific permissions.

Allows AWS resources or services to assume the identity and use the permissions of this role.

Attach the IAM role to the EC2 instances using an EC2 instance profile.

The EC2 instances now have access to retrieve security credentials for the assumed IAM role via the Instance Metadata Service (IMDS).

Enables the application to fetch temporary credentials automatically through the AWS SDK without hardcoding keys.

Key Concept

EC2 Instance Profiles and IAM Roles

Estimated Time:1m 30s

Question 270Question →

An enterprise has an on-premises data processing application that runs on physical servers in a local data center. The application needs to upload large volumes of processed transaction logs to an Amazon S3 bucket in the company's AWS production account. The company's security policy strictly prohibits the use of long-term credentials, such as IAM access keys, stored on local servers. A solutions architect must design a secure authentication and authorization mechanism for this application. Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Configure AWS Identity and Access Management (IAM) Roles Anywhere by establishing a trust anchor with an on-premises Certificate Authority (CA).

Create an IAM role with a trust policy that allows the IAM Roles Anywhere service principal to assume the role, and attach the necessary permissions for Amazon S3.

Create a dedicated IAM user, generate AWS access keys, and configure the on-premises application to retrieve the access keys dynamically from an AWS Systems Manager Parameter Store parameter of type String.

Generate an AWS access key pair for the AWS account root user to allow the on-premises application uninterrupted administrative access to the Amazon S3 bucket.

Create a permanent IAM user in the AWS account for each physical server, generate long-term access keys, and use identity federation to rotate the keys daily.

Show answer & explanation

Answer: Configure AWS Identity and Access Management (IAM) Roles Anywhere by establishing a trust anchor with an on-premises Certificate Authority (CA).; Create an IAM role with a trust policy that allows the IAM Roles Anywhere service principal to assume the role, and attach the necessary permissions for Amazon S3.

Answer

Establish a trust anchor using an on-premises Certificate Authority (CA) in AWS IAM Roles Anywhere, and create an IAM role trusting the IAM Roles Anywhere service principal with the necessary Amazon S3 permissions.

The correct strategy relies on AWS IAM Roles Anywhere. First, establishing a trust anchor with the company's Certificate Authority allows IAM Roles Anywhere to authenticate local servers using digital certificates. Second, creating an IAM role that trusts the IAM Roles Anywhere service principal allows the authenticated servers to acquire temporary security credentials to write to the Amazon S3 bucket, meeting all requirements without storing long-term credentials.

Step-by-Step Solution

Select a mechanism to authenticate non-AWS workloads securely without static credentials.

Identify AWS IAM Roles Anywhere as the ideal solution to issue short-term AWS credentials to on-premises servers using public key infrastructure (PKI).

IAM Roles Anywhere eliminates the security risks associated with storing long-term credentials on local physical servers.

Establish trust between the local CA and AWS.

Create a trust anchor in IAM Roles Anywhere pointing to the on-premises Certificate Authority (CA).

This allows AWS to verify the identity of the physical servers when they present their certificates signed by the local CA.

Authorize the authenticated servers to write to Amazon S3.

Configure an IAM role with a trust policy allowing the service principal 'rolesanywhere.amazonaws.com' to assume the role, and attach the required S3 bucket policies or permissions.

When the servers successfully authenticate, IAM Roles Anywhere will return temporary credentials by assuming this role.

Key Concept

AWS IAM Roles Anywhere enables on-premises workloads to obtain temporary security credentials using X.509 digital certificates, eliminating the need to store long-term IAM access keys on local hardware.

Question 271Question →

A Solutions Architect is setting up a new multi-account AWS environment using AWS Organizations. The company's security policy requires centralized management of user access across all AWS accounts, allowing employees to log in using their existing corporate credentials. Which approach should the Solutions Architect recommend to meet these requirements securely?

Enable AWS IAM Identity Center in the organization, and integrate it with the corporate identity provider for centralized user access.

Create individual IAM users in each AWS member account, and generate access keys for each corporate user to authenticate.

Share the credentials of the management account's AWS account root user with all administrators to perform daily operations.

Enable cross-account access by configuring IAM user policies that allow direct login via the management account's root user credentials.

Show answer & explanation

Answer: Enable AWS IAM Identity Center in the organization, and integrate it with the corporate identity provider for centralized user access.

Answer

Enable AWS IAM Identity Center in the organization, and integrate it with the corporate identity provider for centralized user access.

Enabling AWS IAM Identity Center and integrating it with the corporate identity provider is the AWS-recommended best practice for managing centralized user access across a multi-account organization. It allows employees to use their existing credentials and supports role-based access control with temporary credentials.

Step-by-Step Solution

Identify the primary requirement: centralized management of user access across multiple AWS accounts in an organization using corporate credentials.

Requires a federated single sign-on (SSO) solution.

Centralized federation avoids managing individual credentials per account.

Evaluate AWS services suitable for centralized federation across AWS Organizations.

AWS IAM Identity Center provides built-in integration with external identity providers and centralized permission management.

It natively supports multi-account environments under AWS Organizations.

Eliminate options that require creating individual IAM users or using root credentials.

Options proposing individual IAM users or root user credentials are secure-practice violations.

They violate the principle of least privilege and represent management overhead.

Key Concept

Centralized Multi-Account Identity Federation

Estimated Time:45s

Question 272Question →

A corporation uses an external identity provider (IdP) to manage its workforce identities. A solutions architect must configure access to the AWS Management Console for $200$ developers. Which strategy aligns with AWS security best practices to grant this access?

Configure identity federation using AWS IAM Identity Center to allow the developers to sign in using their existing corporate credentials.

Create individual IAM users in the AWS account for each of the

200

developers and configure password policies for console access.

Provide the developers with the AWS account root user credentials to ensure they have all necessary permissions to perform their tasks.

Create a single shared IAM user with administrator access and distribute the access keys in a plaintext text file on a shared network drive.

Show answer & explanation

Answer: Configure identity federation using AWS IAM Identity Center to allow the developers to sign in using their existing corporate credentials.

Answer

Configure identity federation using AWS IAM Identity Center to leverage existing corporate credentials and centralize management.

Configuring identity federation using AWS IAM Identity Center allows developers to sign in with their existing corporate credentials. This approach centralizes access management, avoids the creation of long-term credentials like IAM passwords or access keys, and scales efficiently as the organization grows.

Step-by-Step Solution

Analyze the request: grant AWS console access to

200

developers already managed in an external corporate identity provider.

Identified that managing

200

local IAM users manually is inefficient and insecure compared to federating the existing identity provider.

AWS security best practices advocate for federated access over creating long-term IAM credentials for workforce users.

Select AWS IAM Identity Center as the correct AWS service for managing SSO access to AWS accounts.

Developers can log in with their corporate credentials without new IAM users being generated.

AWS IAM Identity Center simplifies access management by delegating authentication to the corporate IdP.

Key Concept

Workforce identity federation is the AWS-recommended method for granting corporate directory users access to AWS resources, minimizing credential management overhead.

Estimated Time:45s

Question 273Question →

A financial services firm hosts a banking API on AWS using an Application Load Balancer (ALB) and Amazon EC2 instances in a private subnet. The API has recently been targeted by sudden HTTP flood attacks consisting of a high volume of HTTP POST requests, which exhaust the CPU resources of the backend EC2 instances. The firm needs to mitigate these application-layer (Layer 7) attacks at the network edge before they reach the ALB. Which solution should a solutions architect recommend?

Configure stateless Network Access Control Lists (NACLs) at the subnet level to block incoming traffic based on the rate and payload of HTTP POST requests.

Configure a security group on the Application Load Balancer to dynamically rate-limit incoming HTTP POST requests and block offending clients.

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate AWS WAF with the CloudFront distribution using a rate-based rule.

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and rely on AWS Shield Standard to inspect and block the Layer 7 HTTP POST request floods.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate AWS WAF with the CloudFront distribution using a rate-based rule.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate AWS WAF with the CloudFront distribution using a rate-based rule.

The correct solution uses Amazon CloudFront as a caching and distribution layer at the AWS edge to act as the first line of defense. By associating AWS WAF with the CloudFront distribution, the architecture can inspect Layer 7 HTTP traffic. A WAF rate-based rule counts requests from individual IP addresses and temporarily blocks them if they exceed a defined threshold (e.g., 100 requests per 5 minutes). This prevents the HTTP flood from reaching the regional Application Load Balancer and overloading the backend EC2 instances.

Step-by-Step Solution

Analyze the attack vector and mitigation requirements.

The attack is a Layer 7 HTTP flood (POST requests) causing CPU exhaustion on backend servers, which must be blocked at the edge before hitting the ALB.

Identifying the layer of the attack (Layer 7) determines the tool needed (AWS WAF) rather than network-level firewalls (Security Groups or NACLs).

Evaluate the architectural entry point for edge protection.

Amazon CloudFront distributes traffic across AWS edge locations, absorbing Layer 3 and 4 traffic globally.

Deploying CloudFront allows the security controls to be evaluated close to the client, preventing malicious traffic from reaching the regional VPC resources.

Select the appropriate security service and rule type for Layer 7 rate limiting.

AWS WAF with a rate-based rule is associated with the CloudFront distribution.

AWS WAF rate-based rules automatically track request rates from individual IP addresses and apply a block action once the configured threshold is breached, mitigating HTTP floods dynamically.

Key Concept

Layer 7 DDoS mitigation at the AWS network edge using Amazon CloudFront and AWS WAF rate-based rules.

Estimated Time:1m 30s

Question 274Question →

A gaming company is deploying a new multiplayer gaming lobby API on AWS. The company needs to protect the API endpoint against distributed denial of service (DDoS) attacks at the network layer, and block malicious Layer 7 request patterns such as HTTP floods. Which combination of AWS services should a Solutions Architect recommend to meet these requirements? (Select TWO.)

Select all that apply

AWS WAF to analyze and block malicious application-layer (Layer 7) web requests.

AWS Shield Advanced to provide automatic mitigation against distributed denial of service (DDoS) attacks at the network and transport layers (Layer 3 and 4).

Network Access Control Lists (NACLs) configured to dynamically track request rates and block IP addresses at the edge.

Security groups applied at the subnet level to filter out volumetric DDoS attacks.

AWS Shield Standard to inspect and block Layer 7 vulnerabilities such as SQL injection.

Show answer & explanation

Answer: AWS WAF to analyze and block malicious application-layer (Layer 7) web requests.; AWS Shield Advanced to provide automatic mitigation against distributed denial of service (DDoS) attacks at the network and transport layers (Layer 3 and 4).

Answer

The correct services are AWS WAF and AWS Shield Advanced.

To satisfy both requirements, the Solutions Architect should recommend AWS WAF and AWS Shield Advanced. AWS WAF protects the API endpoint at the application layer (Layer 7) by inspecting incoming request characteristics and implementing rate limits. AWS Shield Advanced protects resources against Layer 3 and Layer 4 volumetric attacks, ensuring infrastructure-level availability.

Step-by-Step Solution

Analyze the requirement for blocking application-layer (Layer 7) attacks, such as HTTP floods.

Identify AWS WAF as the service designed to inspect HTTP/HTTPS payloads and execute rate-based blocking.

AWS WAF operates at Layer 7 and can inspect headers, query strings, and request rates.

Analyze the requirement for blocking infrastructure-layer (Layer 3 and 4) DDoS attacks.

Identify AWS Shield Advanced as the service designed to mitigate volumetric network-layer attacks.

AWS Shield Advanced offers tailored detection and automatic mitigation against L3/L4 DDoS attacks on endpoints.

Key Concept

AWS Edge Security and DDoS Mitigation Layer Separation

Question 275Question →

A company's security team identifies malicious traffic originating from a single public IP address ( $198.51.100.45$ ). A solutions architect must immediately block all incoming traffic from this specific IP address to an entire public subnet. Which of the following actions should the solutions architect take to meet this requirement?

Add an inbound deny rule for the malicious IP address in the Network Access Control List (Network ACL) associated with the public subnet.

Add an inbound deny rule for the malicious IP address in the Security Group associated with the EC2 instances in the public subnet.

Associate a new AWS WAF web ACL with the public subnet and create a rule to block the malicious IP address.

Modify the route table associated with the public subnet to route the malicious IP address to a blackhole target.

Show answer & explanation

Answer: Add an inbound deny rule for the malicious IP address in the Network Access Control List (Network ACL) associated with the public subnet.

Answer

Add an inbound deny rule for the malicious IP address in the Network Access Control List (Network ACL) associated with the public subnet.

The correct answer describes adding an inbound deny rule to the Network ACL associated with the public subnet. Network ACLs operate at the subnet level and are stateless, allowing Solutions Architects to define both allow and deny rules. This allows for blocking a single malicious IP address from reaching any resource inside the subnet.

Step-by-Step Solution

Determine the scope of the restriction.

The requirement is to block traffic at the subnet level, rather than individual instances.

This helps determine whether to use an instance-level control (Security Group) or a subnet-level control (Network ACL).

Evaluate filtering rules capability.

To block a specific IP address, an explicit deny rule is required. Security Groups only support allow rules, while Network ACLs support both allow and deny rules.

Since the goal is to deny traffic, the solutions architect must use a Network ACL.

Apply the configuration.

Add an inbound rule in the Network ACL with a rule number lower than the default allow rule, targeting the IP address

198.51.100.45/32

with a DENY action.

Network ACL rules are evaluated in order of rule numbers, so placing the deny rule first ensures that the traffic is rejected before hitting generic allow rules.

Key Concept

Subnet-level traffic filtering using Network ACLs

Question 276Question →

An enterprise is designing a multi-account strategy using AWS Organizations. An application running on Amazon ECS tasks in the Production Account (Account A) must retrieve database credentials from AWS Secrets Manager in the Security Account (Account B). The secret in Account B is encrypted using a customer managed KMS key. The development team must also be federated into both accounts using their corporate Identity Provider (IdP) to manage these workloads. The architecture must satisfy security audits, enforce automatic rotation of credentials, and adhere to the principle of least privilege. Which combination of actions should the solutions architect take to meet these requirements securely? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center integrated with the corporate SAML 2.0 Identity Provider (IdP) to manage console access, and assign developers to appropriate permission sets in both Account A and Account B.

Attach an IAM role to the ECS task definition in Account A that grants permissions to retrieve the secret and decrypt with the KMS key. In Account B, update the resource-based policy of the secret and the key policy of the KMS key to permit access from the ECS task IAM role.

Create individual IAM users in Account B for each developer, and configure the corporate IdP to assume these user identities using AWS Security Token Service (STS) long-term access keys.

Enable automatic key rotation for the customer managed KMS key in Account B, ensuring that all existing Secrets Manager secrets are immediately re-encrypted using the new key version and the older key version is deleted.

Store the database credentials as a plaintext String parameter in Systems Manager Parameter Store in Account A to avoid cross-account KMS decryption and IAM configuration, and allow the ECS task to read this parameter directly.

Show answer & explanation

Answer: Configure AWS IAM Identity Center integrated with the corporate SAML 2.0 Identity Provider (IdP) to manage console access, and assign developers to appropriate permission sets in both Account A and Account B.; Attach an IAM role to the ECS task definition in Account A that grants permissions to retrieve the secret and decrypt with the KMS key. In Account B, update the resource-based policy of the secret and the key policy of the KMS key to permit access from the ECS task IAM role.

Answer

To meet the requirements, the solutions architect should configure AWS IAM Identity Center integrated with the corporate SAML 2.0 Identity Provider (IdP) to manage console access, and attach an IAM role to the ECS task definition in Account A that has permission to retrieve the secret and decrypt using the KMS key, while configuring the resource-based policy of the secret and the KMS key policy in Account B to trust the ECS task role.

The correct solution involves setting up AWS IAM Identity Center for federated single sign-on access to eliminate the need for local IAM users, and establishing cross-account access by combining identity-based policies (ECS task role) in the source account with resource-based policies (the secret and KMS key policies) in the target account.

Step-by-Step Solution

Configure AWS IAM Identity Center integrated with the corporate SAML 2.0 IdP.

Developers can single sign-on to multiple AWS accounts (Account A and Account B) using temporary credentials instead of long-term IAM user access keys.

This satisfies security audits and complies with the best practice of avoiding long-term access credentials.

Create an IAM role in Account A, attach permissions to access Secrets Manager and KMS decrypt, and assign this role as the ECS Task Role in the task definition.

The application containers run with the specific IAM identity containing only the permissions required to retrieve the secret.

This adheres to the principle of least privilege by avoiding giving permissions to the ECS container instance profile.

Configure resource-based policies in Account B for the Secrets Manager secret and the Customer Managed KMS Key to trust the ECS Task Role ARN from Account A.

The ECS Task in Account A is authorized to read the secret in Account B and decrypt the ciphertext.

Cross-account access requires permissions to be granted on both the identity-based policy (ECS task role) and the resource-based policies (KMS key policy and Secrets Manager secret policy).

Key Concept

Cross-account access delegation using IAM roles, resource policies, KMS key policies, and IAM Identity Center federation.

Question 277Question →

An enterprise architecture consists of a primary production workload running on Amazon ECS in the us-east-1 region, and a testing suite running in a secondary development AWS account. The production ECS tasks must connect to a Multi-AZ Amazon Aurora PostgreSQL database. The security policy mandates that database credentials must be rotated every 30 days without application downtime, and all sensitive data at rest must be encrypted using a customer managed key (CMK). Additionally, a non-sensitive configuration file containing public API endpoints must be shared with the testing suite in the development account. The operations team wants to implement these requirements while minimizing ongoing AWS costs and administrative overhead. Which design meets these requirements?

Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days using the AWS-provided rotation Lambda function. Encrypt the secret using a KMS customer managed key (CMK). Store the non-sensitive public API endpoints as standard String parameters in Systems Manager Parameter Store, and allow the development account to access them by assuming a cross-account IAM role in the production account.

Store the database credentials as SecureString parameters in Systems Manager Parameter Store. Configure AWS KMS to automatically rotate the customer managed key (CMK) every 30 days, which will rotate the underlying database password. Store the public API endpoints as String parameters in Parameter Store, and apply a resource-based policy to share them with the development account.

Store both the database credentials and the public API endpoints as standard String parameters in Systems Manager Parameter Store to eliminate Secrets Manager costs. Create an Amazon EventBridge rule that runs every 30 days to trigger a custom AWS Lambda function that rotates the database credentials and updates the Parameter Store values.

Store the database credentials in AWS Secrets Manager and the public API endpoints in AWS Secrets Manager. Enable automatic rotation on the KMS customer managed key (CMK) encrypting the database credentials secret, which will automatically rotate the database password in RDS and re-encrypt all historical database backups under the new key version.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days using the AWS-provided rotation Lambda function. Encrypt the secret using a KMS customer managed key (CMK). Store the non-sensitive public API endpoints as standard String parameters in Systems Manager Parameter Store, and allow the development account to access them by assuming a cross-account IAM role in the production account.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation enabled using the AWS-provided rotation Lambda function, and encrypt them with a KMS customer managed key (CMK). Store the non-sensitive public API endpoints as standard String parameters in Systems Manager Parameter Store, and share them with the development account using a cross-account IAM role.

The correct solution uses AWS Secrets Manager for the database credentials, which supports native, automated rotation via Lambda for Aurora PostgreSQL and integrates with KMS for encryption at rest. For the non-sensitive public API endpoints, using Systems Manager Parameter Store standard String parameters is the most cost-effective approach since standard parameters are free. Since Parameter Store does not support resource-based policies, sharing them with the development account is securely accomplished by having the development account assume a cross-account IAM role.

Step-by-Step Solution

Select the appropriate storage for database credentials.

Database credentials must be stored in AWS Secrets Manager to support automated rotation using the built-in RDS/Aurora rotation Lambda templates.

Systems Manager Parameter Store does not natively support automated database credential rotation templates, and using Secrets Manager meets the 30-day rotation security requirement with minimal operational overhead.

Ensure encryption of the sensitive credentials.

Encrypt the Secrets Manager secret using an AWS KMS customer managed key (CMK) to comply with the encryption at rest mandate.

Customer managed keys provide granular control over key rotation and access policies.

Optimize costs for non-sensitive data and share it cross-account.

Store public API endpoints as standard String parameters in Systems Manager Parameter Store, and allow cross-account access by assuming an IAM role.

Standard String parameters in Systems Manager Parameter Store are free, avoiding the cost of storing non-sensitive data in Secrets Manager. Since Parameter Store does not support resource-based policies, a cross-account IAM role in the production account must be assumed by the dev account.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on rotation capabilities, cost optimization, and cross-account access mechanisms.

Question 278Question →

A company is transitioning to a multi-account environment managed by AWS Organizations. The solutions architect is designing a centralized identity and governance strategy. The company plans to federate its corporate identity provider with AWS IAM Identity Center. The security team requires that no local IAM users or programmatic access keys be created within any member accounts, except for a pre-authorized emergency break-glass role. The management account must remain unaffected to ensure emergency access is not locked out. Which strategy should the solutions architect recommend to meet these requirements with the least operational overhead?

Create a Service Control Policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions unless the caller is the emergency break-glass role, and attach this SCP to the Organizational Units containing the member accounts.

Manually create IAM users in each member account corresponding to corporate identity provider groups, and attach an IAM policy to each user denying the iam:CreateUser and iam:CreateAccessKey actions.

Configure the root user of each member account to enforce local policies restricting IAM user creation, and perform daily administrative activities in the member accounts using these root credentials.

Create an IAM group in each member account with policies denying credential creation, and require administrators to log in using the management account's root user credentials to perform all member account administrative actions.

Show answer & explanation

Answer: Create a Service Control Policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions unless the caller is the emergency break-glass role, and attach this SCP to the Organizational Units containing the member accounts.

Answer

The correct strategy uses AWS Organizations Service Control Policies (SCPs) to establish permission guardrails across Organizational Units (OUs) containing member accounts. By applying a condition that excludes the emergency break-glass role, the exception is maintained. Because SCPs do not restrict the management account, it remains unaffected by design, ensuring emergency access is preserved.

Step-by-Step Solution

Identify the governance requirement to restrict local IAM user and credential creation across member accounts while leaving the management account unaffected.

Realized that Service Control Policies (SCPs) applied at the Organizational Unit (OU) level are the standard mechanism to restrict permissions globally across target accounts without impacting the management account.

SCPs cannot restrict the management account itself, making them ideal to enforce policies on member accounts while leaving the management account unrestricted.

Formulate the policy rule to deny the specific IAM actions (iam:CreateUser and iam:CreateAccessKey).

Created a deny statement targeting the specific creation APIs.

This directly prevents the creation of local IAM users and long-term credentials.

Apply a condition to allow an exception for the emergency break-glass role.

Added a StringNotLike or StringNotEquals condition checking the caller's ARN against the break-glass role ARN.

This ensures the emergency recovery path remains functional even when the policy is active.

Key Concept

Enforcing security guardrails across multiple AWS accounts in an organization using Service Control Policies (SCPs) combined with AWS IAM Identity Center for centralized federation.

Question 279Question →

A solutions architect is configuring network security for Amazon EC2 instances in a VPC. The instances must receive inbound HTTPS traffic from the internet and be able to send outbound requests to download updates. Which two statements correctly describe the behavior of security groups and network access control lists (network ACLs) for this traffic? (Select TWO.)

Select all that apply

A security group is stateful, which means allowing inbound HTTPS traffic automatically allows the return outbound traffic.

A network ACL is stateless, which means allowing inbound HTTPS traffic requires an outbound rule to allow return traffic on ephemeral ports.

A security group is stateless, so an outbound rule must be configured to allow return traffic for the inbound HTTPS connections.

A network ACL is stateful, which means allowing inbound HTTPS traffic automatically allows the return outbound traffic.

Security groups operate at the subnet level to protect all instances, while network ACLs operate at the individual network interface level.

Show answer & explanation

Answer: A security group is stateful, which means allowing inbound HTTPS traffic automatically allows the return outbound traffic.; A network ACL is stateless, which means allowing inbound HTTPS traffic requires an outbound rule to allow return traffic on ephemeral ports.

Answer

Security groups are stateful (allowing inbound traffic automatically allows the return outbound traffic) and network ACLs are stateless (allowing inbound traffic requires an outbound rule to allow return traffic on ephemeral ports).

Security groups are stateful firewalls. When you allow inbound HTTPS traffic, the security group tracks the connection state and automatically permits return traffic outbound. Conversely, network ACLs are stateless and do not track connection states. Therefore, allowing inbound traffic requires an explicit outbound rule to permit return traffic, which typically utilizes ephemeral ports.

Step-by-Step Solution

Analyze the stateful behavior of AWS Security Groups.

Security groups are stateful, meaning any inbound traffic allowed on a port (like port 443 for HTTPS) automatically allows the corresponding return outbound traffic on ephemeral ports.

This determines if security groups need explicit outbound rules for return traffic.

Analyze the stateless behavior of AWS Network ACLs.

Network ACLs are stateless, meaning they do not track connection states. Inbound traffic allowed must also be explicitly allowed outbound (usually using ephemeral ports 1024-65535) to let response packets return.

This determines if network ACLs need explicit outbound rules for return traffic.

Evaluate the scoping level of Security Groups and Network ACLs.

Security groups operate at the instance/network interface level, whereas network ACLs operate at the subnet level as a firewall.

This verifies the boundaries and application scope of both security mechanisms.

Key Concept

Stateful security groups vs stateless network ACLs

Question 280Question →

An organization's software application requires access to two configurations: a static partner API token that does not change, and a backend database password that must rotate automatically every 45 days. The organization wants a cost-effective solution that keeps both secrets encrypted at rest. Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager and configure automatic rotation.

Store the static partner API token as a SecureString parameter in AWS Systems Manager Parameter Store.

Store the database password as a String parameter in AWS Systems Manager Parameter Store.

Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store and enable automatic rotation on the default aws/ssm KMS key.

Store the static partner API token as a String parameter in AWS Systems Manager Parameter Store and restrict access using a custom IAM policy.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation.; Store the static partner API token as a SecureString parameter in AWS Systems Manager Parameter Store.

Answer

Store the database password in AWS Secrets Manager and configure automatic rotation, and store the static partner API token as a SecureString parameter in AWS Systems Manager Parameter Store.

AWS Secrets Manager is ideal for credentials that require lifecycle management and automatic rotation. Storing the static partner API token as a SecureString parameter in AWS Systems Manager Parameter Store is the most cost-effective and secure method for static secrets that do not require rotation.

Step-by-Step Solution

Analyze the requirements for the static partner API token.

The token is static, does not require automatic rotation, but must be encrypted at rest. Standard parameters of type SecureString in AWS Systems Manager Parameter Store provide free, secure, encrypted storage.

Parameter Store is more cost-effective than AWS Secrets Manager for secrets that do not require rotation.

Analyze the requirements for the database password.

The password requires automatic rotation every 45 days. AWS Secrets Manager natively integrates with AWS Lambda to rotate credentials automatically.

AWS Systems Manager Parameter Store does not natively support automatic rotation of secrets, making AWS Secrets Manager the correct choice for this requirement.

Key Concept

Choosing between AWS Secrets Manager and AWS Systems Manager Parameter Store based on rotation requirements and cost.

PreviousPage 14 / 22Next

Design Secure Architectures

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept