Examkin

Soru

Zorluk: Çok zorIdentity and Access Management (IAM)

A company is building a hybrid application where an on-premises server must upload log files directly to an Amazon S3 bucket. Additionally, a third-party auditing agency requires temporary, read-only access to inspect the S3 bucket's access configurations. To meet compliance standards, the company must avoid configuring or managing long-term AWS credentials for either the on-premises server or the external auditors. Which of the following solutions should the company implement to meet these requirements? (Select TWO.)

  1. Configure AWS Identity and Access Management (IAM) Roles Anywhere to enable the on-premises server to exchange digital certificates for short-term AWS credentials.Cevap
  2. Configure identity federation using a SAML 2.0 or OpenID Connect (OIDC) identity provider to allow the external auditors to assume an IAM role.Cevap
  3. C
    Generate access keys for the AWS Account Root User, encrypt them, and configure the on-premises server to use these credentials for its API calls.
  4. D
    Create a dedicated IAM User for the on-premises server, generate long-term programmatic access keys, and assign administrative permissions.
  5. E
    Submit a request to AWS Support to configure the necessary permissions and manage the lifecycle of the external auditor credentials.

Cevap

The correct solutions are configuring AWS Identity and Access Management (IAM) Roles Anywhere for the on-premises application to exchange digital certificates for temporary credentials, and configuring federation using a SAML 2.0 or OpenID Connect (OIDC) identity provider to allow the external auditors to assume an IAM role.
Configuring AWS Identity and Access Management (IAM) Roles Anywhere allows the on-premises server to authenticate using public key infrastructure (PKI) certificates to dynamically obtain temporary credentials. Setting up SAML 2.0 or OIDC federation allows external auditors to leverage their existing identity provider to assume an IAM role, obtaining temporary credentials for the audit duration without needing permanent IAM user accounts.

Adım Adım Çözüm

1
Analyze the requirements for the on-premises server, which needs programmatic access to S3 without managing long-term security keys.
Identify that AWS IAM Roles Anywhere is designed specifically to grant temporary credentials to workloads outside of AWS using public key infrastructure (PKI) certificates.
This satisfies the requirement to avoid managing long-term AWS credentials for on-premises servers.
2
Analyze the requirements for the third-party auditors who need temporary, administrative-free access to read S3 bucket access logs.
Identify that federation using external identity providers (SAML 2.0 or OIDC) allows external users to assume IAM roles with temporary credentials dynamically.
This eliminates the administrative overhead of managing local IAM users for third-party auditing partners.
3
Evaluate the distractors against AWS security best practices and the Shared Responsibility Model.
Discard the options to use the root account credentials, create permanent IAM users with access keys, or rely on AWS Support to configure customer security settings.
These distractors introduce security risks, use long-term credentials, or misinterpret the boundaries of the Shared Responsibility Model.

Anahtar Kavram

Programmatic access security using temporary credentials (IAM Roles Anywhere and Identity Federation) in place of long-term credentials (IAM Users and Root accounts).
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru