Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

An enterprise wants to allow its employees to log in to the AWS Management Console using their existing corporate credentials managed by an on-premises identity provider. The security team mandates that employees must not have permanent AWS IAM user credentials. Which of the following IAM features or mechanisms should the enterprise use to implement this configuration?

  1. Federate identities using an IAM role that trusts the external corporate identity providerCevap
  2. B
    Create individual IAM users for each employee and configure AWS to sync their passwords with the corporate network
  3. C
    Share the AWS account root user credentials securely using an enterprise password vault
  4. D
    Configure the on-premises identity provider as a managed service within the AWS Shared Responsibility Model

Cevap

Federate identities using an IAM role that trusts the external corporate identity provider
Federating identities with an IAM role that trusts the external corporate identity provider allows employees to obtain temporary credentials to access the AWS Management Console. This avoids the administrative overhead and security risks associated with creating and managing permanent IAM users for each employee.

Adım Adım Çözüm

1
Analyze the business and security requirements
The solution must integrate an on-premises identity provider with AWS to allow console access without creating permanent AWS IAM users.
This establishes the constraints: federation/temporary credentials must be used, and IAM users must be avoided.
2
Evaluate the IAM capabilities for external identity integration
AWS IAM supports identity federation using OpenID Connect (OIDC) or SAML 2.0. By establishing a trust relationship, external users are mapped to temporary security credentials via IAM roles.
This matches the requirement for no permanent credentials while enabling single sign-on.
3
Identify and eliminate incorrect options
Creating individual IAM users creates permanent credentials. Sharing root user credentials violates root security practices. Assuming AWS manages on-premises identity systems is a misunderstanding of the Shared Responsibility Model.
This leaves the role-based identity federation option as the only secure and compliant answer.

Anahtar Kavram

IAM Identity Federation and Temporary Access
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru