Examkin

Question

Difficulty: HardStrengthening Identity, Access, and Network Security

A company is reviewing the security configuration of an existing hybrid application. The application runs on physical servers in an on-premises data center and connects to AWS over an AWS Direct Connect connection. Currently, the on-premises servers retrieve database credentials from AWS Secrets Manager and upload backup files to an Amazon S3 bucket. Authentication is handled using long-term IAM user access keys stored locally in configuration files, and all API calls traverse the public internet. A Solutions Architect must strengthen the security posture by implementing passwordless authentication for the servers and ensuring that all network traffic to AWS services remains private and does not traverse the public internet.

Which two actions should the Solutions Architect take to meet these requirements?

  1. Configure AWS IAM Roles Anywhere by establishing a trust anchor with the on-premises Private Certificate Authority (CA) and creating a role profile, and install the IAM Roles Anywhere credential helper on the on-premises servers to exchange X.509 certificates for short-lived IAM session credentials.Answer
  2. Create Interface VPC Endpoints for Amazon S3 and AWS Secrets Manager in the VPC, and configure Route 53 Resolver inbound endpoints to allow the on-premises DNS servers to resolve the AWS service endpoints to the private IP addresses of the interface endpoints.Answer
  3. C
    Configure AWS IAM Identity Center and set up a SAML 2.0 federated trust relationship, and run a scheduled cron job on the on-premises servers to execute the aws sso login command non-interactively using saved user credentials to retrieve temporary credentials daily.
  4. D
    Create Gateway VPC Endpoints for Amazon S3 and AWS Secrets Manager in the VPC, and update the on-premises route tables to route all traffic for these services directly to the Gateway Endpoint IP addresses over a Private Virtual Interface.
  5. E
    Enable AWS KMS encryption for the Secrets Manager secrets using the default AWS managed key (aws/secretsmanager), and modify the KMS key policy to delegate decryption permissions to the IAM entities representing the on-premises servers.

Answer

The correct actions are to configure AWS IAM Roles Anywhere with a trust anchor pointing to the on-premises Private CA and install the credential helper on the servers, and to create Interface VPC Endpoints for Amazon S3 and AWS Secrets Manager combined with Route 53 Resolver inbound endpoints.
Establishing a trust anchor using AWS IAM Roles Anywhere enables secure certificate-based authentication for on-premises systems, removing the risks associated with long-term IAM access keys. Furthermore, deploying Interface VPC Endpoints for S3 and Secrets Manager coupled with Route 53 Resolver inbound endpoints guarantees that all API requests route privately over the AWS Direct Connect path, satisfying the requirements for private network paths.

Step-by-Step Solution

1
Configure AWS IAM Roles Anywhere with a trust anchor pointing to the on-premises Private CA and map it to a role profile.
On-premises servers can exchange their X.509 digital certificates for short-lived, temporary IAM credentials.
This removes the need for storing long-term IAM access keys on on-premises physical hardware, satisfying the passwordless requirement.
2
Create Interface VPC Endpoints for both Amazon S3 and AWS Secrets Manager inside the target VPC.
Elastic Network Interfaces (ENIs) with private IP addresses are provisioned in the VPC subnets for S3 and Secrets Manager.
Interface VPC Endpoints (AWS PrivateLink) allow network traffic to traverse AWS Direct Connect privately from on-premises environments.
3
Deploy Route 53 Resolver inbound endpoints and configure the on-premises DNS forwarding rules.
DNS requests for S3 and Secrets Manager from the on-premises servers are forwarded to the inbound endpoints, resolving to the private interface endpoint IPs.
This ensures DNS resolution resolves the services to the private IPs instead of public IP addresses, maintaining a private network path.

Key Concept

Securing hybrid architectures by establishing passwordless identity verification using AWS IAM Roles Anywhere and setting up private network connectivity via Interface VPC Endpoints and Route 53 Resolver inbound endpoints.
Estimated Time:3m 0s
Rate this question

Topics

Strengthening Identity, Access, and Network Security