Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

A company has a fleet of Amazon EC2 instances that need to dynamically retrieve customer reports from a private Amazon S3 bucket. The lead developer wants to ensure that the application on these instances has secure, programmatic access without hardcoding credentials or exposing the account to security risks. Which approach aligns with the AWS-recommended best practice for granting this access?

  1. Create an IAM role with an attached policy allowing S3 read permissions, and associate this role with an EC2 instance profile.Cevap
  2. B
    Create an IAM user, generate long-term access keys with S3 read permissions, and store them in the application configuration files on the EC2 instances.
  3. C
    Use the AWS account root user credentials to configure the AWS Command Line Interface (CLI) on each EC2 instance to guarantee uninterrupted bucket access.
  4. D
    Submit a request to AWS Support asking them to configure the underlying hypervisor to allow the EC2 instances to bypass S3 bucket policies.

Cevap

Create an IAM role with an attached policy allowing S3 read permissions, and associate this role with an EC2 instance profile.
The correct approach is to create an IAM role with the appropriate S3 permissions and attach it to the EC2 instances using an instance profile. This allows the application on the EC2 instances to retrieve temporary security credentials dynamically, eliminating the need to store static, long-term access keys on the instance.

Adım Adım Çözüm

1
Analyze the access requirement for an EC2 instance application to retrieve data from a private S3 bucket.
The application needs programmatic access to S3 bucket APIs.
Identifying the resource and access pattern helps narrow down correct credential types.
2
Eliminate choices suggesting the use of permanent, long-term credentials or root user access on EC2 instances.
Discard methods relying on hardcoded IAM user access keys or root account credentials.
Hardcoding access keys or using the root user violates the principle of least privilege and exposes the account to significant security risks.
3
Distinguish between customer and AWS responsibility regarding resource configuration and access control.
Understand that S3 bucket policies and EC2 access permissions are managed by the customer, not AWS Support.
According to the AWS Shared Responsibility Model, Identity and Access Management configuration is 'security in the cloud' and lies entirely with the customer.
4
Apply the recommended IAM mechanism for temporary programmatic access from AWS services.
Select the option that configures an IAM role associated with an EC2 instance profile.
IAM roles provide temporary, automatically rotated security credentials to applications running on EC2 instances, eliminating key management overhead and security leaks.

Anahtar Kavram

Identity and Access Management (IAM) Roles and Access Control Best Practices
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru