Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A software startup wants to allow a third-party vendor to run automated test suites against resources in its AWS development account. The vendor requires programmatic access for a limited time, and the startup must ensure that no long-term credentials are shared or stored. Which of the following is the most secure AWS-recommended method to grant this access?

  1. A
    Create a permanent IAM user with administrator permissions and share the access keys with the vendor.
  2. B
    Generate and share access keys from the AWS account root user to ensure the vendor has full access to run any test.
  3. Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.Cevap
  4. D
    Submit a support ticket requesting that the AWS Support team run the testing suite within the customer's environment.

Cevap

Create an IAM role with the necessary permissions that the vendor can assume to obtain temporary security credentials.
The correct answer is to create an IAM role. IAM roles allow external entities to assume permissions and receive temporary security credentials via the AWS Security Token Service (STS). This avoids the need to distribute or manage long-term secrets, fulfilling the requirement of temporary access securely.

Adım Adım Çözüm

1
Identify the key requirements of the scenario.
The third-party vendor requires programmatic access for a limited time, and credentials must not be long-term or shared.
This establishes that the solution must support temporary access without sharing permanent credentials.
2
Compare the security mechanisms of IAM users, roles, and the root user.
IAM users and root users utilize long-term credentials, whereas IAM roles issue temporary credentials that expire automatically.
Choosing the correct IAM entity ensures adherence to AWS security best practices.
3
Verify ownership and operational boundaries under the Shared Responsibility Model.
Executing scripts and configuring access is a customer-side responsibility, ruling out direct management by AWS Support.
This eliminates options that assume AWS manages tenant-level operational tasks.

Anahtar Kavram

Using IAM roles for temporary, cross-account, or third-party access instead of sharing long-term credentials.
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru