Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is deploying a web application on an Amazon EC2 instance that needs to read and write files to an Amazon S3 bucket. Which of the following is the AWS-recommended best practice to grant the application access to the S3 bucket?

  1. A
    Create an IAM user with S3 permissions, generate access keys, and store them directly in the application configuration files on the EC2 instance.
  2. B
    Use the AWS account root user credentials inside the application configuration to guarantee access to the S3 bucket.
  3. Create an IAM role with the necessary S3 permissions and attach it to the Amazon EC2 instance.Cevap
  4. D
    Rely on the AWS shared responsibility model, which automatically grants access permissions between compute and storage services within the same account.

Cevap

Create an IAM role with the necessary S3 permissions and attach it to the Amazon EC2 instance.
Creating an IAM role and attaching it to the Amazon EC2 instance is the recommended practice. AWS handles the rotation of temporary security credentials automatically, preventing the security risks associated with managing and storing long-term credentials on the instance.

Adım Adım Çözüm

1
Determine if the requester is an AWS service or a human user.
The requester is an Amazon EC2 instance running a web application.
AWS services should use roles with temporary credentials rather than users with permanent access keys to access other AWS services.
2
Identify the permissions needed and apply the principle of least privilege.
Create a policy that permits only read and write actions on the specific S3 bucket.
Ensuring least privilege minimizes the potential impact of a security compromise.
3
Associate the permissions with the EC2 instance using a role.
Attach the policy to an IAM role, and then associate that role with the EC2 instance.
The application on the EC2 instance can then retrieve temporary security credentials automatically from instance metadata.

Anahtar Kavram

Granting temporary credentials to AWS resources using IAM roles is a fundamental security best practice.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru