An enterprise has an existing on-premises application that currently uses long-lived AWS IAM user access keys to upload large data logs to an Amazon S3 bucket. To strengthen security, a Solutions Architect is tasked with refactoring the authentication mechanism to use short-lived credentials via AWS IAM Roles Anywhere. The enterprise already operates an internal Certificate Authority (CA). Which combination of actions should the Solutions Architect perform to implement this security improvement? (Select two.)
- Create a trust anchor in AWS IAM Roles Anywhere by registering the certificate of the internal Certificate Authority (CA), and define a profile that specifies the IAM role that the on-premises application can assume.Answer
- Create an IAM role with a trust policy that allows the sts:AssumeRole, sts:TagSession, and sts:SetSourceIdentity actions, and trusts the rolesanywhere.amazonaws.com service principal.Answer
- CConfigure the trust policy of the IAM role to use the sts:AssumeRoleWithSAML action, and configure the on-premises application to authenticate against a SAML 2.0 identity provider.
- DAttach a Service Control Policy (SCP) to the member account that permits the sts:AssumeRole action for the service principal rolesanywhere.amazonaws.com without configuring local trust policies on the target IAM role.
- EConfigure default encryption on the S3 bucket using the AWS-managed KMS key aws/s3, and modify the key policy of aws/s3 to allow the rolesanywhere.amazonaws.com service principal to perform cryptographic actions.
Answer
Create a trust anchor in AWS IAM Roles Anywhere by registering the certificate of the internal Certificate Authority (CA), define a profile that specifies the IAM role, and create an IAM role with a trust policy that trusts the rolesanywhere.amazonaws.com service principal and allows the sts:AssumeRole, sts:TagSession, and sts:SetSourceIdentity actions.
The correct options implement IAM Roles Anywhere by registering the external CA certificate as a trust anchor and defining a profile referencing the role, while configuring the role trust policy to trust the rolesanywhere.amazonaws.com service principal with sts:AssumeRole, sts:TagSession, and sts:SetSourceIdentity actions.
Step-by-Step Solution
Key Concept
AWS IAM Roles Anywhere enables on-premises workloads to authenticate securely with AWS using local X.509 certificates to obtain short-lived IAM credentials, replacing static access keys.