Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A fintech startup is deploying a transaction processing application on AWS. They need to configure access control for two distinct scenarios: first, an application running on an Amazon EC2 instance that needs to read and write transactions to an Amazon DynamoDB table; second, a cloud engineer who requires access to the AWS Management Console to monitor resources. Which of the following identity and access management practices should the startup implement? (Select TWO.)

  1. A
    Create an IAM user for the EC2 instance, generate long-term access keys, and store them directly in the application configuration file.
  2. Configure an IAM role with the minimum permissions required to access the DynamoDB table and attach it to the EC2 instance profile.Cevap
  3. Create a dedicated IAM user for the cloud engineer, assign permissions using an IAM group, and enable multi-factor authentication (MFA).Cevap
  4. D
    Provide the cloud engineer with the AWS account root user credentials to perform daily management tasks and avoid permission issues.
  5. E
    Configure AWS to automatically manage OS-level login credentials on the EC2 instance, as securing the guest operating system is a responsibility managed entirely by AWS.

Cevap

The startup should configure an IAM role with the minimum permissions for DynamoDB access and attach it to the EC2 instance profile, and also create a dedicated IAM user for the cloud engineer, assigning permissions through an IAM group with multi-factor authentication (MFA) enabled.
The correct configurations involve using an IAM role for the EC2 instance to safely access the DynamoDB table via temporary credentials, and creating a dedicated IAM user with MFA and group-based permissions for the cloud engineer. These steps adhere to the AWS best practices of avoiding root user usage for daily operations and utilizing temporary credentials where possible.

Adım Adım Çözüm

1
Identify the access requirements for the EC2 instance application.
The application needs access to a DynamoDB table. Instead of using long-term credentials like an IAM user's access keys, the secure approach is to use temporary credentials.
Attaching an IAM role to the EC2 instance profile provides the application with temporary, automatically rotated credentials, eliminating the risk of exposed secrets.
2
Identify the access requirements for the cloud engineer.
The engineer needs to access the console. The best practice is to create a dedicated IAM user with permissions managed via a group and protect the account with multi-factor authentication (MFA).
Using the root user for daily activities is highly discouraged, and group-based permissions simplify access management while MFA adds an extra layer of security.

Anahtar Kavram

AWS Identity and Access Management (IAM) best practices for applications and administrators
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru