Examkin

Question

Difficulty: HardIdentity and Access Management Architecture

An enterprise security architecture team is designing an automated identity mechanism to allow microservices running on an Amazon Web Services (AWS) Kubernetes cluster to securely request data from resources hosted on Google Cloud Platform (GCP). The solution must eliminate static, long-lived service account access keys, provide automated credential rotation, and cryptographically establish workload identity trust across cloud providers. Which of the following Identity and Access Management (IAM) architectural solutions best meets these requirements?

  1. Configure Workload Identity Federation using OpenID Connect (OIDC) to exchange AWS-issued short-lived identity tokens for temporary GCP access tokens.Answer
  2. B
    Establish an encrypted IPsec VPN tunnel between cloud providers and configure microservices to authenticate using static IAM service account keys over the private network.
  3. C
    Implement SAML 2.0 web browser Single Sign-On (SSO) to continuously authenticate service account roles between the AWS and GCP IAM control planes.
  4. D
    Deploy an inline Web Application Firewall (WAF) to intercept outbound microservice API traffic and dynamically inject bearer tokens from a central secrets vault.

Answer

Configure Workload Identity Federation using OpenID Connect (OIDC) to exchange AWS-issued short-lived identity tokens for temporary GCP access tokens.
Workload Identity Federation allows external workloads (such as Kubernetes pods in AWS) to authenticate to cloud providers (such as GCP) by leveraging OpenID Connect (OIDC). The requesting workload presents a short-lived, signed JSON Web Token (JWT) issued by its native OIDC identity provider, which GCP validates against a configured trust relationship before issuing temporary GCP IAM credentials. This eliminates the necessity for static secret storage, key rotation management, and long-lived credential risks.

Step-by-Step Solution

1
Identify key architectural requirements from scenario
Requirements are: cross-cloud machine-to-machine authentication, elimination of static/long-lived access keys, automated rotation, and short-lived credential issuance.
Security architecture in multi-cloud environments must avoid static API keys due to risks of credential exposure and key management overhead.
2
Evaluate workload identity federation mechanisms
Workload Identity Federation utilizes standard OIDC/OAuth2 protocols to allow GCP to trust identity tokens signed by the AWS OIDC provider.
This establishes cryptographically verifiable trust and yields short-lived, temporary access tokens specifically bound to the requesting workload.
3
Eliminate non-viable and misaligned architectural approaches
IPsec VPNs only secure network transport and retain static keys; SAML SSO targets interactive user sessions; WAF injection misapplies inline application filtering to identity management.
Only federated OIDC token exchange fulfills both the Zero Trust identity paradigm and automated machine-to-machine access requirements.

Key Concept

Workload Identity Federation across Multi-Cloud Environments
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic