Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

A logistics company is integrating its on-premises inventory server with AWS. The server must automatically upload daily reports to an Amazon S3 bucket. To comply with strict security standards, the company prohibits storing long-term AWS access keys on the physical on-premises server. Which configuration represents the most secure AWS-recommended best practice to grant this access?

  1. A
    Create an IAM user with programmatic access, attach the required S3 policy, and store the long-term access keys in an encrypted file on the server.
  2. B
    Generate access keys for the AWS account root user, and configure the server's backup script to use these credentials for direct authentication.
  3. Configure AWS IAM Roles Anywhere on the on-premises server to obtain temporary, short-lived security credentials using local digital certificates.Cevap
  4. D
    Modify the S3 bucket policy to grant write access to the public, relying entirely on the on-premises server's source IP address restriction for security.

Cevap

Configure AWS IAM Roles Anywhere on the on-premises server to obtain temporary, short-lived security credentials using local digital certificates.
The configuration utilizing AWS IAM Roles Anywhere is correct because it allows on-premises physical hardware to authenticate using local digital certificates (X.509) and assume an IAM role. This process returns temporary, short-lived security credentials (access key, secret key, and session token), successfully eliminating the need to store long-term keys on the server.

Adım Adım Çözüm

1
Analyze the security constraints.
The solution must allow the on-premises server to write to Amazon S3 without storing long-term credentials (like IAM access keys) on the physical hardware.
This filters out any options that rely on permanent IAM user access keys or root user access keys.
2
Identify the AWS mechanism for extending roles to non-AWS hardware.
AWS IAM Roles Anywhere is identified as the service designed to grant secure, temporary AWS credentials to on-premises servers using public key infrastructure (PKI) certificates.
IAM Roles allow applications to obtain temporary security credentials dynamically, removing the need for long-term keys.
3
Evaluate alternative methods to ensure they meet security best practices.
Using public S3 buckets with IP filters is rejected as insecure and an abuse of bucket policies.
AWS access should always be authenticated and authorized via IAM policies and temporary credentials where possible.

Anahtar Kavram

AWS IAM Roles Anywhere enables on-premises workloads to securely access AWS resources using temporary IAM credentials derived from local X.509 digital certificates, eliminating long-term credentials.

Alternatif Yöntem

An alternative method is to register the on-premises server as an AWS Systems Manager (SSM) managed instance using Systems Manager Hybrid Activations, allowing it to assume IAM roles through the SSM Agent.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru