A company is deploying an application on Amazon Elastic Compute Cloud (Amazon EC2) that must securely read data from an Amazon Simple Storage Service (Amazon S3) bucket and write results to an Amazon DynamoDB table. The security team mandates that no long-term credentials be stored on the instance and that the principle of least privilege be strictly followed. Which of the following actions should the company perform to meet these security requirements? (Select TWO.)
- Create an IAM role with a trust policy that allows the Amazon EC2 service to assume the role, and associate it with the EC2 instance profile.Cevap
- Attach an IAM policy to the IAM role that explicitly grants 's3:GetObject' and 'dynamodb:PutItem' permissions on the specific resources.Cevap
- CCreate an IAM user with programmatic access keys, assign the required S3 and DynamoDB permissions, and store the keys in the EC2 instance's configuration files.
- DEnable multi-factor authentication (MFA) for the AWS Account Root User and configure the application to authenticate using the root user access keys.
- EConfigure AWS Shield to automatically manage the application's access rights and handle database permission requests.
Cevap
Creating an IAM role with a trust policy that allows the Amazon EC2 service to assume the role, associating it with the EC2 instance profile, and attaching an IAM policy that explicitly grants only the necessary S3 read and DynamoDB write permissions to that role.
To secure applications on EC2, the best practice is to assign an IAM role to the EC2 instance profile. The application can then fetch temporary credentials automatically via the AWS SDK. To follow the principle of least privilege, a policy should be attached to this role that limits access to only the specific S3 and DynamoDB actions required.
Adım Adım Çözüm
Anahtar Kavram
AWS Identity and Access Management (IAM) Roles and Least Privilege Policy Design
Tahmini Süre:1m 30s