Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

A retail company's security team is auditing its AWS environment. An application hosted on Amazon EC2 instances must access a private Amazon S3 bucket to process transaction logs, and an external security consultant requires temporary access to review the IAM configurations. Which TWO of the following options represent AWS-recommended security practices to implement these requirements?

  1. Attach an IAM role to the EC2 instances that provides the minimum necessary permissions to access the S3 bucket.Cevap
  2. Establish cross-account access by creating an IAM role that the external security consultant can assume.Cevap
  3. C
    Generate long-term IAM access keys, embed them directly in the application configuration files on the EC2 instances, and create a shared IAM user for the consultant.
  4. D
    Use the AWS account root user credentials to configure the application access and grant the consultant access to the root account.
  5. E
    Submit a support ticket asking AWS to perform the security audit and manage the consultant's access to the third-party system.

Cevap

The correct practices are attaching an IAM role to the EC2 instances for secure S3 access and establishing cross-account access using an IAM role for the external consultant.
The recommended approach to secure application workloads on Amazon EC2 is to attach an IAM role, which automatically manages rotation of temporary credentials. To grant secure access to external auditors, companies should set up cross-account access via an IAM role with a trust policy, ensuring that the external partner uses their own account credentials to authenticate.

Adım Adım Çözüm

1
Identify the compute resource security requirements: For Amazon EC2 instances to access other AWS resources like S3, the recommended best practice is to delegate access via IAM roles, which leverage temporary credentials instead of hardcoded long-term keys.
Using IAM roles for EC2 instances removes the need to store long-term keys on the server.
This reduces the risk of credential exposure if the EC2 instance is compromised.
2
Identify the external access requirements: For third-party users or consultants who already have their own AWS accounts, cross-account IAM roles should be configured to allow access without creating local IAM users or sharing credentials.
Establishing cross-account IAM roles allows secure, auditable, and temporary access.
This follows the security principle of identity isolation and avoids sharing credentials or creating unnecessary IAM user profiles.

Anahtar Kavram

AWS IAM Best Practices for EC2 Instances and Cross-Account Access
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru