Security

390 soru

Tüm türler390 Çoktan seçmeli195 Çoklu seçim195

A developer is building a document processing application that must secure sensitive PDF documents before uploading them to a third-party storage service. The average size of each document is $15\text{ MB}$ . To meet security requirements, the developer must encrypt the documents client-side using an AWS KMS Customer Managed Key (CMK) while minimizing latency and network overhead. Which approach should the developer implement to encrypt these documents securely and efficiently?

Call the KMS Encrypt API directly, passing the raw document binary as the plaintext parameter along with the CMK ARN, and store the returned ciphertext.

Call the KMS GenerateDataKey API with the CMK to obtain a plaintext data key and an encrypted data key. Encrypt the document locally using the plaintext data key, delete the plaintext key from memory, and store the encrypted data key alongside the encrypted document.

Call the KMS GenerateDataKeyWithoutPlaintext API to retrieve an encrypted data key. Send the encrypted data key to the KMS Decrypt API to get the plaintext key, encrypt the document locally, and store the encrypted data key with the document.

Retrieve a pre-generated symmetric key stored in AWS Systems Manager Parameter Store as a SecureString parameter using the GetParameter API. Encrypt the document locally with this key and discard the retrieved parameter value.

Cevabı ve açıklamayı göster

Cevap: Call the KMS GenerateDataKey API with the CMK to obtain a plaintext data key and an encrypted data key. Encrypt the document locally using the plaintext data key, delete the plaintext key from memory, and store the encrypted data key alongside the encrypted document.

Cevap

The correct approach is to call the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the document locally, and is then discarded from memory. The encrypted data key is stored alongside the encrypted document so that it can be decrypted later using the Decrypt API. This utilizes envelope encryption, which is necessary because the documents exceed the size limit of the direct KMS Encrypt API.

Adım Adım Çözüm

Evaluate the file size (

15\text{ MB}

) against AWS KMS direct encryption payload limits.

Since the direct KMS Encrypt API has a strict limit of

4\text{ KB}

, direct encryption is not possible. Envelope encryption must be used.

To select the appropriate KMS workflow based on payload size constraints.

Determine the most efficient API call for obtaining data keys for client-side envelope encryption.

GenerateDataKey returns both the plaintext key (for local encryption) and the encrypted key (for storage) in a single network request.

To minimize latency and network calls during document upload processing.

Validate security best practices for handling the generated plaintext data key.

Once the document is encrypted locally with the plaintext key, the plaintext key is deleted from application memory, and the encrypted key is packaged with the ciphertext.

To ensure the plaintext key is not exposed or leaked.

Anahtar Kavram

Client-side envelope encryption workflow using AWS KMS GenerateDataKey API

Tahmini Süre:2m 0s

Soru 2Soru →

A developer is implementing an AWS Lambda function in Account A ( $111111111111$ ) that needs to retrieve database credentials stored as a secure parameter in the Systems Manager Parameter Store in Account B ( $222222222222$ ). The parameter is encrypted using an AWS KMS customer managed key (CMK) in Account B. The developer intends to use the AWS Security Token Service (STS) to assume an IAM role named `DbConfigReaderRole` in Account B.

The Lambda function is associated with an execution role named `LambdaExecutionRole` in Account A.

Which of the following configuration steps must be performed to allow the Lambda function to retrieve the configuration parameter? (Select TWO.)

Geçerli olan tümünü seçin

In Account B, configure the trust policy for `DbConfigReaderRole` to allow the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole` to perform the `sts:AssumeRole` action.

In Account A, attach a policy to `LambdaExecutionRole` that grants `sts:AssumeRole` permissions on the resource `arn:aws:iam::222222222222:role/DbConfigReaderRole`.

In Account B, attach an identity-based permission policy to `DbConfigReaderRole` that grants `sts:AssumeRole` permissions to the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole`.

In the Lambda function code, configure the AWS SDK client to initialize credentials by hardcoding the access keys of an IAM user in Account B that has permissions to read the parameter.

In Account B, attach a resource-based policy directly to the Systems Manager Parameter that grants `ssm:GetParameter` permissions to the `LambdaExecutionRole` in Account A.

Cevabı ve açıklamayı göster

Cevap: In Account B, configure the trust policy for `DbConfigReaderRole` to allow the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole` to perform the `sts:AssumeRole` action.; In Account A, attach a policy to `LambdaExecutionRole` that grants `sts:AssumeRole` permissions on the resource `arn:aws:iam::222222222222:role/DbConfigReaderRole`.

Cevap

The configuration requires adding the calling role as a trusted principal in the trust policy of the target role in Account B, and granting permission to assume the target role in the identity-based policy of the caller's role in Account A.

For cross-account access via STS, two distinct components are required: the target role's trust policy must list the source principal as a trusted entity, and the source identity's permissions policy must permit the call to assume the target role.

Adım Adım Çözüm

Identify the cross-account trust requirement.

The target role `DbConfigReaderRole` in Account B (

222222222222

) must explicitly trust the Lambda execution role in Account A (

111111111111

) via its trust policy.

Without this trust relationship, STS will deny the assume role request from Account A's principal.

Identify the delegation permission requirement.

The source execution role `LambdaExecutionRole` in Account A must be granted permission to perform the `sts:AssumeRole` action on the target role's ARN in Account B.

By default, IAM execution roles do not have permission to assume arbitrary external roles; this must be explicitly allowed.

Differentiate trust policies from identity-based policies and resource-based policies.

Confirm that trust relationships are defined in trust policies (not identity-based policies) and that Systems Manager Parameter Store does not support resource policies.

This rules out the incorrect options that attempt to configure trust in permissions policies or use non-existent parameter resource policies.

Anahtar Kavram

IAM Policies and Roles

Tahmini Süre:2m 0s

Soru 3Soru →

A developer is deploying a containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The application needs to retrieve data from an Amazon DynamoDB table. The developer creates an IAM role named AppDynamoDBRole with a permissions policy that allows dynamodb:GetItem and dynamodb:Query operations, and configures the task definition's taskRoleArn parameter to point to this role. The trust policy for AppDynamoDBRole is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the containerized application runs, it fails to authenticate with DynamoDB, and the container logs show an authorization error when attempting to assume the task role. Which of the following modifications to the configuration will resolve this issue?

Change the Service value under the Principal block in the trust policy from ecs.amazonaws.com to ecs-tasks.amazonaws.com.

Change the taskRoleArn configuration in the task definition to executionRoleArn, and attach the DynamoDB permissions to the task execution role.

Change the Action in the trust policy from sts:AssumeRole to sts:AssumeRoleWithWebIdentity.

Add the ecs:StartTask permission to the executionRoleArn to authorize the containers to initiate the assume role action.

Cevabı ve açıklamayı göster

Cevap: Change the Service value under the Principal block in the trust policy from ecs.amazonaws.com to ecs-tasks.amazonaws.com.

Cevap

Change the Service value under the Principal block in the trust policy from ecs.amazonaws.com to ecs-tasks.amazonaws.com.

The correct option is changing the Service principal to ecs-tasks.amazonaws.com. When configuring an ECS task definition, the taskRoleArn parameter allows containerized applications to make authorized AWS API calls. To enable this, the ECS agent must assume the designated IAM role. The trust relationship policy of the IAM role must explicitly allow the ECS tasks service principal (ecs-tasks.amazonaws.com) to perform the sts:AssumeRole action.

Adım Adım Çözüm

Examine the trust policy of the IAM role to determine who is permitted to assume it.

The current trust policy permits the ecs.amazonaws.com service principal to assume the role.

This determines if the correct AWS service or identity has been granted trust.

Identify the service principal responsible for launching and executing ECS tasks.

ECS tasks run under the ecs-tasks.amazonaws.com service principal, whereas service-level control plane operations run under ecs.amazonaws.com.

The correct service principal must match the specific entity requesting the sts:AssumeRole action.

Update the trust policy to authorize the ecs-tasks.amazonaws.com service principal.

The ECS agent can now successfully assume the AppDynamoDBRole on behalf of the containerized application.

This establishes a valid trust relationship, resolving the authorization error.

Anahtar Kavram

IAM trust policies for Amazon ECS tasks must trust the ecs-tasks.amazonaws.com service principal to allow the ECS agent to assume the task role on behalf of containers.

Tahmini Süre:2m 0s

Soru 4Soru →

A developer is building a serverless client-side web application. Users will log in using an Amazon Cognito User Pool. Once authenticated, the application must interact directly with AWS services from the browser to download user-specific documents from an Amazon S3 bucket, restricted to the path `documents/${cognito-identity.amazonaws.com:sub}/*`, and write application usage telemetry directly to an Amazon Kinesis Data Stream. The developer wants to implement this with the least operational overhead and without managing any backend API or compute resources. Which TWO actions should the developer take to configure this solution?

Geçerli olan tümünü seçin

Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and associate an authenticated IAM role that permits `s3:GetObject` on the prefix `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.

Configure the client application to exchange the Cognito User Pool ID token for temporary AWS credentials using the Cognito Identity Pool.

Configure the client application to pass the Cognito User Pool Access token directly in the Authorization header of the requests to the Amazon S3 and Kinesis Data Streams endpoints.

Deploy an Amazon API Gateway REST API with a Cognito User Pool Authorizer, and route the client requests through the API to access S3 and Kinesis.

Generate long-term IAM User access keys with the required S3 and Kinesis permissions, and embed them in the client application code.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and associate an authenticated IAM role that permits `s3:GetObject` on the prefix `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.; Configure the client application to exchange the Cognito User Pool ID token for temporary AWS credentials using the Cognito Identity Pool.

Cevap

The developer should create an Amazon Cognito Identity Pool configured with the User Pool as an identity provider, assigning an authenticated IAM role that permits Kinesis and user-restricted S3 access. Additionally, the client application must exchange the Cognito User Pool ID token for temporary AWS credentials using the Identity Pool.

To interact directly with AWS services like Amazon S3 and Amazon Kinesis from a client-side application, temporary AWS credentials are required. By creating a Cognito Identity Pool and configuring the User Pool as an identity provider, you can exchange the User Pool ID token for temporary AWS IAM credentials. The authenticated IAM role associated with the Identity Pool can restrict S3 access to user-specific folders using the `${cognito-identity.amazonaws.com:sub}` policy variable and grant write permissions to the Kinesis stream, ensuring secure and direct access with minimal operational overhead.

Adım Adım Çözüm

Configure the user directory and federation.

An Amazon Cognito User Pool is set up for authentication, and an Identity Pool is created with the User Pool configured as an identity provider.

This establishes a trust relationship where successful authentication in the User Pool allows the client to request credentials from the Identity Pool.

Define the permissions using an IAM policy on the Identity Pool's authenticated role.

The authenticated IAM role is assigned a policy allowing `s3:GetObject` on `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.

The `${cognito-identity.amazonaws.com:sub}` variable represents the user's Cognito Identity ID, ensuring users can only access their own documents, while Kinesis access allows direct telemetry ingestion.

Exchange tokens for credentials in the client application.

The client authenticates with the User Pool, obtains an ID token, and calls the Identity Pool to get temporary AWS credentials.

These credentials are used by the AWS SDK in the browser to sign requests directly to S3 and Kinesis using Signature Version 4.

Anahtar Kavram

Amazon Cognito Identity Pools enable client-side applications to obtain temporary, limited-privilege AWS credentials by federating identity providers like Cognito User Pools.

Soru 5Soru →

An application running on AWS Fargate generates monthly audit reports (each approximately $8\text{ MB}$ in size) that must be encrypted client-side before they are stored in an external third-party storage system. The developer wants to use AWS Key Management Service (AWS KMS) with a customer managed key to secure these reports.

Which of the following actions must the developer take to implement this client-side encryption workflow? (Select TWO.)

Geçerli olan tümünü seçin

Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.

Call the Encrypt API of AWS KMS to encrypt the audit report directly.

Call the GenerateDataKeyWithoutPlaintext API of AWS KMS to obtain an encrypted data key, and use it to encrypt the audit report locally.

Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString to reuse it for subsequent audit reports.

Cevabı ve açıklamayı göster

Cevap: Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.; Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.

Cevap

To encrypt a file larger than

4\text{ KB}

client-side, the developer must generate a data key by calling the GenerateDataKey API, use the returned plaintext data key to encrypt the report locally, discard the plaintext key from memory, and store the encrypted data key alongside the encrypted audit report.

To encrypt a large file client-side using AWS KMS, the developer must implement envelope encryption. This involves calling the GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the audit report locally, after which the plaintext key is discarded from memory. The encrypted data key is then stored with the encrypted report so that it can be decrypted later by calling the Decrypt API to recover the plaintext key.

Adım Adım Çözüm

Generate a unique data key.

The GenerateDataKey API is called, which returns a plaintext data key and an encrypted data key.

Since the file exceeds the direct encryption limit of AWS KMS, envelope encryption is required. The plaintext key is needed to perform the encryption, and the encrypted key is saved for future decryption.

Encrypt the data locally.

The Fargate container encrypts the

8\text{ MB}

report using the plaintext data key.

This performs the actual cryptographic operation locally without sending the large file to AWS KMS.

Clean up memory and store metadata.

The plaintext key is cleared from the container's memory, and the encrypted data key is written alongside the encrypted report.

Holding the plaintext key longer than necessary in memory presents a security risk, and the encrypted data key is the only way to recover the plaintext key during decryption.

Anahtar Kavram

AWS KMS client-side envelope encryption workflow for objects exceeding the direct encryption size limits.

Soru 6Soru →

A developer is configuring an AWS Lambda function in Account A ( $111122223333$ ) to write data to an Amazon DynamoDB table in Account B ( $444455556666$ ) by assuming an IAM role named `CrossAccountDynamoDBRole` in Account B. The Lambda function's execution role in Account A is named `LambdaExecutionRole`.

When the Lambda function invokes the `AssumeRole` API call using the AWS SDK, the execution fails with the following error:
`User: arn:aws:sts::111122223333:assumed-role/LambdaExecutionRole/my-function is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole`

Which TWO configurations must the developer implement to resolve this error?

Geçerli olan tümünü seçin

Add a permission policy to the LambdaExecutionRole in Account A that allows the sts:AssumeRole action on arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.

Configure the trust policy of CrossAccountDynamoDBRole in Account B to allow the sts:AssumeRole action for the principal arn:aws:iam::111122223333:role/LambdaExecutionRole.

Configure the trust policy of CrossAccountDynamoDBRole in Account B to allow the dynamodb:PutItem action for the principal lambda.amazonaws.com.

Add a permission policy to the LambdaExecutionRole in Account A that allows the dynamodb:PutItem action on the DynamoDB table in Account B.

Hardcode the AWS access keys of an IAM user created in Account B directly into the Lambda function's initialization code.

Cevabı ve açıklamayı göster

Cevap: Add a permission policy to the LambdaExecutionRole in Account A that allows the sts:AssumeRole action on arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.; Configure the trust policy of CrossAccountDynamoDBRole in Account B to allow the sts:AssumeRole action for the principal arn:aws:iam::111122223333:role/LambdaExecutionRole.

Cevap

To allow the Lambda function to perform cross-account access, the developer must grant the sts:AssumeRole permission to the Lambda execution role in Account A and configure the target role in Account B to trust the Lambda execution role in Account A.

The correct configurations involve setting up both sides of the trust boundary. First, the calling role in Account A must be granted permission to perform the sts:AssumeRole action. Second, the trust policy of the target role in Account B must be updated to trust the calling role in Account A as the principal.

Adım Adım Çözüm

Analyze the error message and the configuration requirements.

The error indicates that the Lambda execution role in Account A is not authorized to perform sts:AssumeRole on the cross-account role in Account B.

For cross-account role assumption to succeed, two permissions must match: the caller role must have a permission policy allowing sts:AssumeRole, and the destination role must have a trust policy allowing the caller role to assume it.

Configure the calling side (Account A).

Attach an IAM policy to the LambdaExecutionRole allowing the action sts:AssumeRole on the resource arn:aws:iam::444455556666:role/CrossAccountDynamoDBRole.

This grants the source role the necessary authorization to call the STS AssumeRole API.

Configure the receiving side (Account B).

Update the trust policy of CrossAccountDynamoDBRole to specify the ARN of the LambdaExecutionRole (arn:aws:iam::111122223333:role/LambdaExecutionRole) as the principal and allow sts:AssumeRole.

This establishes the trust relationship, allowing the principal from Account A to assume the role in Account B.

Anahtar Kavram

Cross-account IAM role assumption requires configuration on both the source account (identity policy permitting sts:AssumeRole) and the destination account (trust policy permitting the source identity).

Soru 7Soru →

A developer is designing a web application dashboard for a smart home IoT system. The application needs to allow users to sign in using their email and password or their social identity provider. Once authenticated, the web application must securely download and upload user-specific configuration files directly from an Amazon S3 bucket. Additionally, the application must invoke backend REST API endpoints hosted on Amazon API Gateway, which should only be accessible to authenticated users.

Which Cognito configuration should the developer choose to satisfy these requirements with the least operational overhead?

Configure a Cognito Identity Pool to manage user registration, local password policies, and social provider integration. Secure the API Gateway REST API using an API Gateway Cognito Authorizer with the Identity Pool token, and access the S3 bucket using the same token.

Configure a Cognito User Pool for user authentication and federation. Configure an API Gateway Custom Lambda Authorizer that calls the Cognito Identity Pool credentials exchange API for every request, and use the returned IAM credentials to authorize the user.

Configure a Cognito User Pool to handle registration, login, and social identity provider federation. Secure the API Gateway REST API with a Cognito Authorizer using the User Pool ID token. Configure a Cognito Identity Pool with the User Pool as an identity provider to obtain temporary AWS credentials for S3 access.

Configure a Cognito User Pool to authenticate users. Store static IAM access keys and secret keys in the User Pool's custom user attributes, retrieve these attributes upon login, and use them to sign requests to API Gateway and S3.

Cevabı ve açıklamayı göster

Cevap: Configure a Cognito User Pool to handle registration, login, and social identity provider federation. Secure the API Gateway REST API with a Cognito Authorizer using the User Pool ID token. Configure a Cognito Identity Pool with the User Pool as an identity provider to obtain temporary AWS credentials for S3 access.

Cevap

The correct approach uses an Amazon Cognito User Pool to manage authentication (handling registration, local credentials, and social provider federation) and uses the resulting JSON Web Token (JWT) ID token to authorize API requests via the built-in API Gateway Cognito Authorizer. To access AWS resources like Amazon S3, a Cognito Identity Pool is required to exchange the User Pool tokens for temporary AWS IAM credentials.

Adım Adım Çözüm

Select Cognito User Pools for user sign-in and management.

Users can register, sign in, and federate through social identity providers to receive JWT tokens.

Cognito User Pools serve as the user directory and handle the authentication flow.

Integrate API Gateway with the Cognito User Pool.

API Gateway uses a native Cognito Authorizer to validate incoming ID tokens directly.

This secures the REST API without requiring custom Lambda code or credentials exchange for API calls.

Configure a Cognito Identity Pool with the User Pool as a provider.

The client application exchanges the User Pool token for temporary AWS IAM credentials.

These temporary credentials allow the client application to directly and securely upload files to Amazon S3.

Anahtar Kavram

Distinction between Cognito User Pools (authentication and user directory) and Cognito Identity Pools (authorization and temporary AWS credentials exchange), as well as integrating User Pools with API Gateway Cognito Authorizers.

Tahmini Süre:1m 30s

Soru 8Soru →

A developer is deploying an application on an Amazon EC2 instance. The application is configured to read configuration templates from an Amazon S3 bucket. The developer creates an IAM role named `AppConfigReadRole` with an attached policy that allows `s3:GetObject` on the target bucket. However, the application fails to retrieve the templates and receives an 'Access Denied' error. The developer inspects the trust policy of `AppConfigReadRole` and finds the following document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following modifications to the trust policy will resolve the Access Denied error and allow the EC2 instance to assume the role?

Modify the trust policy statement to allow the `s3:GetObject` action instead of `sts:AssumeRole`.

Embed the AWS Access Key ID and Secret Access Key of a security administrator directly in the application code.

Change the principal service in the trust policy from `lambda.amazonaws.com` to `ec2.amazonaws.com`.

Change the principal service in the trust policy to `ecs-tasks.amazonaws.com` and attach it to the EC2 host's task execution role.

Cevabı ve açıklamayı göster

Cevap: Change the principal service in the trust policy from `lambda.amazonaws.com` to `ec2.amazonaws.com`.

Cevap

Changing the service principal in the trust policy from `lambda.amazonaws.com` to `ec2.amazonaws.com`.

The trust policy of an IAM role determines which principals are allowed to assume it. For an application running on an Amazon EC2 instance to assume a role via an instance profile, the role's trust policy must specify the EC2 service principal (`ec2.amazonaws.com`) under the `Principal.Service` key, along with the `sts:AssumeRole` action. The original policy mistakenly trusted the Lambda service principal (`lambda.amazonaws.com`), which prevented the EC2 instance from assuming the role.

Adım Adım Çözüm

Identify the compute environment where the application is running.

The application is running on an Amazon EC2 instance.

Understanding the host environment determines which AWS service principal needs permission to assume the IAM role.

Examine the trust policy of the `AppConfigReadRole` IAM role.

The principal is currently set to `lambda.amazonaws.com`.

An incorrect principal in a trust policy prevents the target service (EC2) from obtaining temporary credentials to assume the role.

Update the trust policy principal to match the hosting service.

Replace `lambda.amazonaws.com` with `ec2.amazonaws.com` in the trust policy.

This configures the role to trust the EC2 service, allowing the EC2 instance profile to successfully assume the role and access the S3 bucket.

Anahtar Kavram

IAM Role Trust Policies vs Permission Policies for EC2 Instances

Soru 9Soru →

A developer is building a web-based reporting dashboard for an enterprise sales team. Users of the dashboard must authenticate using their email and password. Once authenticated, the client application needs to perform two actions: call a secure REST API hosted on Amazon API Gateway to fetch sales metadata, and download raw report files directly from a private Amazon S3 bucket. The developer wants to use Amazon Cognito to implement the authentication and authorization flows. Which TWO configuration steps should the developer perform to meet these requirements with the least administrative and operational overhead? (Select TWO.)

Geçerli olan tümünü seçin

Set up an Amazon Cognito User Pool to manage user registration and authentication, and configure a Cognito User Pool Authorizer on Amazon API Gateway to secure the REST API.

Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider for it, and map an IAM role with read permissions for the private S3 bucket to authenticated users.

Create a custom API Gateway Lambda Authorizer to decode and validate the JSON Web Tokens (JWT) issued by the Cognito User Pool for each REST API request.

Configure the API Gateway REST API to use AWS IAM authorization, and configure the client application to pass the Cognito User Pool access token directly in the HTTP Authorization header.

Configure the Amazon Cognito User Pool to generate temporary AWS credentials for authenticated users and attach an IAM policy directly to the User Pool to allow S3 access.

Cevabı ve açıklamayı göster

Cevap: Set up an Amazon Cognito User Pool to manage user registration and authentication, and configure a Cognito User Pool Authorizer on Amazon API Gateway to secure the REST API.; Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider for it, and map an IAM role with read permissions for the private S3 bucket to authenticated users.

Cevap

The developer should set up a Cognito User Pool to manage user registration and login, and secure the API Gateway REST API using the native Cognito User Pool Authorizer. Additionally, the developer should create a Cognito Identity Pool linked to the User Pool to grant temporary AWS credentials for S3 bucket access via an authenticated IAM role.

To authenticate users and secure API Gateway REST APIs with the least overhead, a developer should use an Amazon Cognito User Pool combined with API Gateway's native Cognito User Pool Authorizer. To authorize users to download files directly from Amazon S3, the developer must exchange the Cognito User Pool identity tokens for temporary AWS credentials using a Cognito Identity Pool, which maps users to an IAM role with read permissions for the target S3 bucket.

Adım Adım Çözüm

Configure the authentication directory and API security.

An Amazon Cognito User Pool is configured to manage user sign-in and sign-up. The API Gateway REST API is protected by selecting Cognito User Pool Authorizer, which natively parses and validates the client's token.

This establishes user identity and protects the REST API with the lowest operational complexity.

Configure AWS resource authorization.

An Amazon Cognito Identity Pool is created with the Cognito User Pool configured as an identity provider. An IAM role containing read permissions for the target S3 bucket is attached to the Identity Pool's authenticated role.

This allows authenticated users to obtain temporary AWS credentials for direct, secure interaction with the S3 bucket.

Anahtar Kavram

Amazon Cognito User Pools provide authentication and user directories, integrating natively with API Gateway via Cognito Authorizers. Cognito Identity Pools handle authorization by exchanging user identity tokens for temporary AWS credentials to access AWS services directly.

Soru 10Soru →

A developer is securing a REST API in Amazon API Gateway for a social media application. Users authenticate via a web frontend using Amazon Cognito. The developer needs to restrict access to the API Gateway resources to authenticated users only and pass the user's username and email to the backend AWS Lambda function for auditing. The solution must minimize custom code and use built-in API Gateway features. Which two steps must the developer perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods.

In the backend Lambda function, extract the user's identity details from the event.requestContext.authorizer.claims context object.

Configure an API Gateway Cognito Identity Pool Authorizer and associate it with the API methods.

Create an API Gateway Lambda Custom Authorizer to validate the JWT and return an IAM policy allowing the request.

Configure a Lambda Custom Integration (non-proxy) and parse the Authorization header inside the Lambda function using a mapping template.

Cevabı ve açıklamayı göster

Cevap: Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods.; In the backend Lambda function, extract the user's identity details from the event.requestContext.authorizer.claims context object.

Cevap

Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods, and extract the user's identity details from the event.requestContext.authorizer.claims context object in the backend Lambda function.

To secure the API with minimal custom code, the developer should configure an API Gateway Cognito User Pool Authorizer. This built-in authorizer natively validates JSON Web Tokens (JWTs) issued by Cognito User Pools. Once validated, API Gateway automatically propagates the user's token claims (including email and username) to the backend integration, where they can be extracted directly from the requestContext.authorizer.claims context variable inside the Lambda function.

Adım Adım Çözüm

Select the built-in Cognito User Pool Authorizer in API Gateway.

API Gateway is configured to automatically validate the JWT tokens sent by the client frontend.

This avoids writing custom validation code and utilizes AWS managed capabilities.

Associate the authorizer with the specific HTTP/REST methods on the API Gateway resource.

Unauthenticated requests are blocked at the gateway level with a 401 Unauthorized response, protecting the backend.

This secures the endpoints before requests reach the backend Lambda function.

Access the user claims within the Lambda handler using the integration event object.

The Lambda function receives the username and email in the event object without performing additional decoding or verification.

API Gateway automatically populates the claims under requestContext.authorizer.claims when the Cognito authorizer successfully validates the token.

Anahtar Kavram

API Gateway Cognito User Pools Integration

Soru 11Soru →

A developer is designing a secure REST API using Amazon API Gateway that will be consumed by external client applications. The clients authenticate against a third-party Identity Provider (IdP) that is not compatible with Amazon Cognito, receiving a custom JSON Web Token (JWT) that includes specific scopes in the payload. The REST API must authorize access to resources based on these scopes and forward the verified user identity metadata to a backend Lambda function using a Lambda proxy integration. The developer wants to implement a solution that minimizes both authorization latency and cost. Which configuration should the developer implement to meet these requirements?

Configure the API Gateway integration to use a Lambda custom integration with a request mapping template that forwards the custom JWT. Perform the JWT validation and policy evaluation directly inside the backend Lambda function, caching the validation results in an Amazon ElastiCache cluster to minimize authorization latency on subsequent requests.

Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.

Configure a Cognito User Pool authorizer in API Gateway, and link it to an Amazon Cognito Identity Pool that federates with the third-party Identity Provider. Retrieve the custom scopes and user identity metadata from the requestContext.authorizer.claims object in the backend Lambda function, and configure API Gateway caching on the client's IAM role.

Configure a Cognito User Pool authorizer in API Gateway to validate the custom JWT. Set the authorizer's Identity Source to the Authorization header, and configure a custom Lambda integration mapping template to extract the third-party JWT and exchange it for an IAM policy before executing the backend Lambda function.

Cevabı ve açıklamayı göster

Cevap: Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.

Cevap

The correct solution uses an API Gateway Lambda authorizer to validate the third-party JWT. Because the token is not issued by Amazon Cognito, a built-in Cognito authorizer cannot be used. By setting an Identity Source (such as the Authorization header), API Gateway caches the generated IAM policy, preventing downstream invocations of the authorizer Lambda function on subsequent calls with the same token. Additionally, return values in the context object from the authorizer are forwarded to the backend Lambda function under requestContext.authorizer, satisfying the requirement to pass user metadata securely while keeping backend processing optimized.

Adım Adım Çözüm

Create and deploy a Lambda authorizer function that receives the third-party JWT, validates its cryptographic signature against the IdP's public keys, and inspects the payload claims for valid scopes.

The Lambda function is ready to return an IAM policy document and a custom context object containing user metadata.

API Gateway requires a custom Lambda authorizer to inspect and validate third-party tokens since built-in Cognito authorizers only validate Cognito-issued tokens.

Configure the API Gateway REST API to use the Lambda authorizer, set the authorization caching TTL, and specify the Identity Source (such as method.request.header.Authorization).

API Gateway caches the policy document returned by the authorizer for matching tokens, avoiding repeated invocations of the authorizer function.

Caching reduces API latency and reduces the cost of running the authorizer Lambda function on every API request.

Map the required user identity claims to the context object returned by the Lambda authorizer, and use Lambda Proxy Integration for the backend integration.

The backend Lambda function receives the mapped metadata in the requestContext.authorizer object of the incoming event.

Using the context object allows passing validated client metadata to the backend Lambda function securely without requiring the backend function to parse or re-validate the token.

Anahtar Kavram

Using API Gateway Lambda authorizers to validate third-party JSON Web Tokens (JWTs) and caching the authorization policy response to minimize backend invocations.

Tahmini Süre:2m 0s

Soru 12Soru →

A developer is configuring an AWS Step Functions state machine to orchestrate a serverless workflow. The state machine needs to invoke an AWS Lambda function and publish execution status updates to an Amazon SNS topic. During testing, the state machine execution fails with an IAM authorization error. Which of the following configurations are required to resolve this issue and grant the state machine the necessary permissions? (Select TWO.)

Geçerli olan tümünü seçin

Attach an IAM role to the Step Functions state machine with a trust policy that allows the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Attach a permissions policy to the Step Functions execution role that allows the `lambda:InvokeFunction` action on the Lambda function's ARN and the `sns:Publish` action on the SNS topic's ARN.

Configure the Step Functions execution role's trust policy to trust the `lambda.amazonaws.com` and `sns.amazonaws.com` service principals.

Attach an IAM role to the Lambda function and the SNS topic, and configure their trust policies to allow the `states.amazonaws.com` service principal to assume them.

Embed temporary AWS access credentials inside the Step Functions state machine definition parameters to authenticate the Lambda and SNS API requests.

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role to the Step Functions state machine with a trust policy that allows the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action.; Attach a permissions policy to the Step Functions execution role that allows the `lambda:InvokeFunction` action on the Lambda function's ARN and the `sns:Publish` action on the SNS topic's ARN.

Cevap

To resolve the authorization issue, you must configure a trust policy on the Step Functions execution role allowing the `states.amazonaws.com` service principal to perform `sts:AssumeRole`, and attach a permissions policy to that execution role that allows the `lambda:InvokeFunction` and `sns:Publish` actions on the target resource ARNs.

AWS Step Functions must assume an IAM role to perform tasks like invoking Lambda functions or publishing messages to SNS. For the service to assume this role, the trust policy must explicitly allow the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action. Additionally, the role itself must be granted permissions via an attached permissions policy to perform `lambda:InvokeFunction` and `sns:Publish` on the specific resources.

Adım Adım Çözüm

Determine the executing principal that requires access.

The executing principal is the AWS Step Functions service (`states.amazonaws.com`).

Step Functions requires an IAM execution role to make API calls to other AWS resources on behalf of the user.

Establish the trust relationship for the execution role.

Add a trust policy to the role allowing `states.amazonaws.com` to call `sts:AssumeRole`.

Without this trust policy, the Step Functions service cannot assume the role to retrieve temporary security credentials.

Define the resource permissions for the execution role.

Attach an identity-based permissions policy granting `lambda:InvokeFunction` and `sns:Publish` on the respective ARNs.

Once the role is assumed, Step Functions must have the explicit authorization to perform the required actions on the target resources.

Anahtar Kavram

Configuring IAM execution roles requires establishing a trust policy that permits the calling service principal to assume the role, combined with a permissions policy that grants the role access to perform actions on specific resources.

Soru 13Soru →

A developer is configuring a backend microservice running on AWS Lambda within a custom VPC. The Lambda function must connect to a private Amazon Aurora PostgreSQL database in the same VPC and retrieve secure configurations from AWS Systems Manager Parameter Store. The company's security policy strictly prohibits internet gateways and NAT gateways. The developer sets up an Interface VPC Endpoint for Systems Manager. Which two configurations must the developer implement to secure this traffic and establish connectivity? (Select TWO.)

Geçerli olan tümünü seçin

Configure the database's security group to allow inbound TCP traffic on port

5432

from the security group assigned to the Lambda function.

Configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port

443

) traffic from the security group assigned to the Lambda function.

Add a route in the private subnet route table pointing destination

0.0.0.0/0

to the Systems Manager VPC Endpoint network interface.

Configure the private subnet's Network Access Control List (NACL) to allow inbound traffic from the database, relying on the stateful nature of NACLs to permit return traffic.

Modify the Lambda execution role's trust policy to allow the Systems Manager service endpoint (ssm.amazonaws.com) to assume the role.

Cevabı ve açıklamayı göster

Cevap: Configure the database's security group to allow inbound TCP traffic on port $5432$ from the security group assigned to the Lambda function.; Configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port $443$ ) traffic from the security group assigned to the Lambda function.

Cevap

Configure the database's security group to allow inbound TCP traffic on port

5432

from the security group assigned to the Lambda function, and configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port

443

) traffic from the security group assigned to the Lambda function.

The database security group must allow inbound PostgreSQL traffic (port

5432

) from the Lambda function's security group. Interface VPC endpoints use security groups to control incoming traffic; therefore, the Systems Manager endpoint's security group must permit inbound HTTPS (port

443

) traffic from the Lambda function's security group. Since security groups are stateful, configuring these inbound rules automatically allows the corresponding outbound/return traffic.

Adım Adım Çözüm

Analyze database connectivity requirements.

Identify that the Lambda function must connect to Aurora PostgreSQL on port

5432

To authorize this traffic, the database's security group must permit inbound traffic from the source (the Lambda function's security group).

Analyze Systems Manager Parameter Store connectivity requirements.

Identify that the Lambda function must connect to Systems Manager via an Interface VPC Endpoint using HTTPS on port

443

To authorize this traffic, the endpoint's security group must allow inbound traffic from the Lambda function's security group.

Evaluate security group statefulness.

Recognize that because security groups are stateful, return traffic is automatically allowed once the inbound/outbound connection is established.

This eliminates the need to configure ephemeral port rules on the security groups.

Anahtar Kavram

VPC security controls (Security Groups, NACLs, and Interface VPC Endpoints) for private AWS service integrations.

Tahmini Süre:2m 30s

Soru 14Soru →

A company is developing a fitness tracking mobile application. The application needs to access a REST API hosted on Amazon API Gateway to retrieve user workout histories. The development team wants to implement an authorization mechanism that allows users to authenticate using their existing email and password credentials, validates their JSON Web Tokens (JWTs) directly at the API Gateway level without invoking a custom Lambda function, and extracts user identity claims for backend processing. Which configuration should the developer implement to meet these requirements with the lowest latency and operational overhead?

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.

Configure an Amazon Cognito Identity Pools authorizer directly on the API Gateway REST API.

Implement a custom Lambda authorizer that fetches public keys from the Cognito User Pool to validate the JWT.

Configure API Gateway with Lambda Proxy integration to inspect and validate the JWT inside the backend integration function.

Cevabı ve açıklamayı göster

Cevap: Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.

Cevap

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.

The correct configuration is to use the built-in Amazon Cognito User Pools authorizer. This option integrates directly with the user pool to authenticate and validate the signature of incoming JWT tokens without invoking custom Lambda code. Once validated, user claims are automatically populated into the request context and sent to the backend integration, providing a highly optimized, low-overhead solution.

Adım Adım Çözüm

Analyze the requirements for user authentication, token validation, and latency control.

The solution requires user directory authentication (username/password), token validation at the API Gateway edge without executing custom code, and access to identity claims in backend integrations.

This establishes that the solution must use a native API Gateway mechanism rather than custom authorizer code.

Select the appropriate Amazon Cognito feature for user directories.

Cognito User Pools provides the directory and authentication flow, returning JWT tokens containing claims.

Cognito Identity Pools provides temporary AWS credentials instead of user authentication directory features.

Configure the native API Gateway authorizer that integrates directly with the Cognito User Pool.

Configuring a Cognito User Pools authorizer on the API Gateway REST API allows native verification of the JWT signature and expiration, and automatically passes the claims via the integration request context.

This provides the lowest latency and requires no custom code maintenance, satisfying all requirements.

Anahtar Kavram

API Gateway Cognito User Pools Authorizer

Soru 15Soru →

A developer is deploying a microservice on Amazon ECS using AWS Fargate that connects to an Amazon Aurora PostgreSQL database. The application must retrieve a database endpoint (non-sensitive configuration) and a database password (sensitive credential). The database password must be automatically rotated every 30 days. The microservice handles a very high volume of requests, so the developer must design a solution that prevents database connection failures after rotation, avoids API throttling errors, and minimizes costs. Which approach should the developer take to retrieve and manage these configurations?

Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.

Store both the database endpoint and the password as standard parameters in Systems Manager Parameter Store. Enable parameter policies to automatically rotate the password parameter every 30 days, and retrieve both values inside the microservice code on every request using the AWS SDK.

Store both the database endpoint and the database password in AWS Secrets Manager. Initialize the Secrets Manager SDK client in the microservice code by passing hardcoded IAM access keys and secret keys of a dedicated IAM user to bypass IAM role credential retrieval latency.

Store the database endpoint in Systems Manager Parameter Store and the database password in AWS Secrets Manager. Reference both the parameter and the secret in the ECS task definition as environment variables, allowing the containerized application to read them directly from the local environment.

Cevabı ve açıklamayı göster

Cevap: Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.

Cevap

The correct strategy combines Systems Manager Parameter Store for non-sensitive configurations and AWS Secrets Manager for sensitive credentials that need automatic rotation. Under high-throughput environments, fetching credentials on every request will cause API throttling. Caching values locally with a Time-to-Live (TTL) ensures low latency and avoids API rate limiting, while the TTL expiration guarantees that the microservice eventually fetches the new password after an automatic rotation, avoiding database connection issues.

Adım Adım Çözüm

Determine the appropriate storage service for each configuration type.

The database endpoint is non-sensitive configuration data, which is most cost-effective to store in Systems Manager Parameter Store. The database password is a sensitive credential requiring automatic rotation, making AWS Secrets Manager the correct choice.

Parameter Store does not charge for standard parameters, while Secrets Manager charges $0.40 per secret per month but supports automatic rotation natively.

Configure the rotation mechanism for the database password.

Enable automatic rotation in Secrets Manager, which uses an AWS Lambda function to update the database password in both Secrets Manager and the Aurora database.

This ensures the credentials remain secure without manual intervention.

Implement a caching strategy inside the microservice application code.

Use the AWS SDK to retrieve the parameters, and cache the values in memory with a reasonable Time-to-Live (TTL). When the TTL expires, the microservice makes a fresh call to the AWS APIs to refresh the cache.

Caching avoids API throttling (ProvisionedThroughputExceededException) and minimizes retrieval latency. The TTL ensures that warm containers periodically refresh their cached credentials, preventing connection failures after a rotation occurs.

Anahtar Kavram

Selecting and integrating AWS Secrets Manager and Systems Manager Parameter Store with caching to support credentials rotation in high-throughput applications.

Soru 16Soru →

A developer is deploying a containerized API to AWS App Runner. The application needs to retrieve credentials for a backend Amazon Aurora MySQL database, which must be rotated automatically every 45 days. Additionally, the application requires access to 50 non-sensitive configuration parameters, such as service endpoints and logging levels, which are updated frequently. The developer wants to implement a secure, cost-effective architecture.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda rotation function template.

Store the non-sensitive logging levels and service endpoints as standard parameters in AWS Systems Manager Parameter Store.

Store both the database credentials and the non-sensitive configuration parameters in AWS Secrets Manager to simplify client-side SDK integration.

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter, and write a custom EventBridge rule to trigger rotation.

Configure the App Runner service environment variables to host the database credentials directly to minimize API call latency.

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda rotation function template.; Store the non-sensitive logging levels and service endpoints as standard parameters in AWS Systems Manager Parameter Store.

Cevap

The correct combination is to store the database credentials in AWS Secrets Manager with built-in Lambda automatic rotation, and store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as standard parameters.

The correct solution uses AWS Secrets Manager for the database credentials because Secrets Manager natively supports automatic rotation using built-in Lambda templates. It uses AWS Systems Manager Parameter Store (standard parameters) for the non-sensitive parameters because standard parameters are free, ensuring the overall architecture is cost-effective.

Adım Adım Çözüm

Analyze credential security and rotation requirements.

Identify that the Aurora database credentials require security and automated rotation every 45 days. AWS Secrets Manager is the optimal service here because it offers out-of-the-box rotation support using Lambda templates specifically integrated with RDS/Aurora.

Ensures credentials are secure and rotated without custom scripting overhead.

Analyze non-sensitive configuration requirements and cost constraints.

Identify that logging levels and service endpoints are non-sensitive and numerous (50 parameters). Storing them in AWS Systems Manager Parameter Store as standard parameters is free, satisfying the cost-efficiency constraint.

Minimizes unnecessary Secrets Manager charges for non-sensitive data.

Anahtar Kavram

Secrets Manager vs Systems Manager Parameter Store

Tahmini Süre:2m 0s

Soru 17Soru →

A developer is designing a microservice that processes sensitive transaction payloads of approximately $1.5\text{ MB}$ each. The microservice must encrypt these payloads before storing them in an on-premises database. The encryption keys must be managed in AWS KMS. Which approach should the developer use to perform the encryption in a secure and efficient manner?

Call the Encrypt API operation directly, passing the payload and the customer managed key identifier, then store the resulting ciphertext in the database.

Store the transaction payloads directly in AWS Systems Manager Parameter Store as SecureString parameters, configuring Parameter Store to use the KMS customer managed key for encryption.

Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.

Call the GenerateDataKeyWithoutPlaintext API operation to obtain an encrypted data key. Decrypt the key locally using a client-side cryptographic library, use it to encrypt the payload, and discard the key.

Cevabı ve açıklamayı göster

Cevap: Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.

Cevap

For data larger than

4\text{ KB}

, developers must use envelope encryption. Calling the GenerateDataKey API provides a plaintext data key to perform local symmetric encryption of the

1.5\text{ MB}

payload and an encrypted copy of the data key. Once encryption is complete, the plaintext data key is discarded from memory, and the encrypted payload is stored alongside the encrypted data key. The encrypted data key can later be sent to KMS Decrypt to retrieve the plaintext key for decryption.

Adım Adım Çözüm

Identify the size limit of the direct KMS Encrypt API and compare it to the transaction payload size.

The transaction payload is

1.5\text{ MB}

, which exceeds the

4\text{ KB}

limit of the direct KMS Encrypt API.

KMS direct encryption cannot process payloads larger than

4\text{ KB}

, requiring the use of envelope encryption.

Evaluate the options for envelope encryption using AWS KMS APIs.

Calling GenerateDataKey provides both the plaintext data key for local encryption and the encrypted data key for storage.

GenerateDataKey generates the keys locally without transmitting the actual data payload to KMS, which is highly efficient.

Complete the envelope encryption workflow locally on the client.

The plaintext key encrypts the payload, is removed from memory, and the encrypted payload is stored with the encrypted data key.

This ensures the plaintext key is not exposed and the data can be decrypted later by decrypting the data key with KMS.

Anahtar Kavram

KMS Envelope Encryption and API Limits

Soru 18Soru →

A developer is designing a secure serverless backend where a single-page application (SPA) needs to access a REST API hosted on Amazon API Gateway. Users authenticate using Amazon Cognito User Pools. The developer needs to implement authorization such that standard users can only invoke the GET methods on /items resources, while administrative users (members of the 'Admins' Cognito group) can invoke any method on /items and /admin resources. Which two configuration steps should the developer perform to implement this authorization model?

Geçerli olan tümünü seçin

Enable AWS_IAM authorization on the API Gateway resources. Integrate the Amazon Cognito User Pool with an Amazon Cognito Identity Pool, configure group-based role mapping to associate the 'Admins' group with a high-privilege IAM role, and have the client application sign API requests using temporary AWS credentials via Signature Version 4.

Configure an API Gateway Lambda Authorizer. In the authorizer function, verify the signature of the JSON Web Token (JWT) provided by the Cognito User Pool, inspect the 'cognito:groups' claim in the payload, and dynamically generate an IAM policy that allows or denies access to the specific resource paths.

Configure a Cognito User Pool Authorizer on the API Gateway resources. In the API Gateway console, use the OAuth Scopes configuration to map the Cognito user groups directly to the corresponding HTTP methods and resource paths of the REST API.

Configure an Amazon Cognito Identity Pool as the API Gateway Authorizer. Send the Cognito ID token in the authorization header, and configure API Gateway to automatically map the token's claims to IAM policy permissions on the backend integration.

Enable AWS_IAM authorization on the API Gateway. Configure the API to use a Lambda Proxy integration, and write logic inside the backend Lambda integration function to query the Amazon Cognito User Pool to retrieve user groups and return a 403 Forbidden status code if unauthorized.

Cevabı ve açıklamayı göster

Cevap: Enable AWS_IAM authorization on the API Gateway resources. Integrate the Amazon Cognito User Pool with an Amazon Cognito Identity Pool, configure group-based role mapping to associate the 'Admins' group with a high-privilege IAM role, and have the client application sign API requests using temporary AWS credentials via Signature Version 4.; Configure an API Gateway Lambda Authorizer. In the authorizer function, verify the signature of the JSON Web Token (JWT) provided by the Cognito User Pool, inspect the 'cognito:groups' claim in the payload, and dynamically generate an IAM policy that allows or denies access to the specific resource paths.

Cevap

To implement group-based authorization on API Gateway with Cognito User Pools, the developer can either use AWS_IAM authorization with Cognito Identity Pools and group-to-role mapping, or implement a Lambda Authorizer that inspects the 'cognito:groups' claim in the JWT and dynamically generates an IAM policy.

The correct options represent the two main architectures for implementing group-based access control in API Gateway. Using AWS_IAM authorization with Cognito Identity Pools maps User Pool groups to distinct IAM roles, letting API Gateway natively enforce authorization via SigV4 signed requests. Using a Lambda Authorizer allows developers to decode the JWT, inspect the 'cognito:groups' claim, and dynamically return an IAM policy allowing or denying access to specific routes.

Adım Adım Çözüm

Identify the authorization requirements.

The system needs to restrict API access based on Cognito groups, which requires mapping groups to specific API paths and methods.

This establishes the scope and logic needed for the authorization policy.

Evaluate the AWS_IAM and Cognito Identity Pool approach.

By mapping user groups to different IAM roles via Cognito Identity Pools, the client can sign requests with SigV4, allowing API Gateway to evaluate permissions natively via IAM policies.

This offloads authorization logic to native AWS features, minimizing custom development.

Evaluate the custom Lambda Authorizer approach.

A Lambda Authorizer can verify the Cognito JWT signature, parse the 'cognito:groups' claim, and dynamically generate an IAM policy based on group membership.

This is standard when the client uses bearer tokens and avoids SigV4 request signing.

Anahtar Kavram

Fine-grained API Gateway authorization using Cognito groups, IAM policies, and Lambda Authorizers

Soru 19Soru →

An application running on Amazon ECS container instances in Account A needs to decrypt sensitive data files stored in an Amazon S3 bucket. The files are encrypted using an AWS KMS Customer Managed Key (CMK) located in Account B. The developer needs to configure the permissions to allow the application to decrypt these files.

Which of the following actions must be taken to grant the application the required permissions? (Choose two.)

Geçerli olan tümünü seçin

In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A.

In Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

In Account A, attach an IAM policy to the ECS task execution role that allows the kms:Decrypt action on the KMS key ARN in Account B.

In Account B, update the S3 bucket policy to grant kms:Decrypt permissions to the application's IAM task role in Account A.

In Account A, retrieve the KMS Customer Managed Key plaintext key material and store it as a SecureString in AWS Systems Manager Parameter Store.

Cevabı ve açıklamayı göster

Cevap: In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A.; In Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

Cevap

In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A; and in Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

Cross-account access to KMS keys requires validation at both the resource level and the identity level. First, the key policy of the Customer Managed Key in Account B must be configured to trust the external account or role. Second, the IAM policy in the application's account (Account A) must grant the application's IAM role permission to call the KMS API. Because the application logic runs within ECS containers, these permissions must be applied to the ECS Task Role.

Adım Adım Çözüm

Differentiate between the ECS task role and the ECS task execution role.

Identify that the application container uses the ECS Task Role for application-level AWS API calls (such as KMS decryption), whereas the Task Execution Role is for container agent operations.

This prevents assigning permissions to the wrong IAM role.

Configure the key-level permissions in the KMS key owner's account (Account B).

Update the KMS key policy in Account B to delegate decrypt permissions to the IAM task role ARN from Account A.

AWS KMS requires the key policy to explicitly allow cross-account access, as identity-based IAM policies in the external account are not sufficient on their own.

Configure the identity-level permissions in the application's account (Account A).

Attach an IAM policy to the ECS Task Role in Account A allowing the kms:Decrypt action on the target KMS key ARN.

For cross-account access, permissions must be allowed on both the resource policy (key policy) and the identity policy (IAM policy).

Anahtar Kavram

Cross-Account KMS Key Access and ECS Task Roles

Tahmini Süre:2m 0s

Soru 20Soru →

A developer is deploying an AWS Lambda function that must connect to an Amazon ElastiCache (Redis OSS) cluster. The ElastiCache cluster is running in the private subnets of a custom VPC. The Lambda function does not need access to the public internet or external APIs. Which of the following configuration steps must the developer perform to establish secure network connectivity between the Lambda function and the ElastiCache cluster? (Select TWO.)

Geçerli olan tümünü seçin

Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group.

Configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

Provision a NAT Gateway in the private subnet and update the subnet route tables to route ElastiCache traffic through it.

Modify the Lambda function's IAM execution role trust policy to allow the ElastiCache service to assume the role.

Store the ElastiCache security group ID in AWS Secrets Manager to automatically authorize traffic and bypass security group checks.

Cevabı ve açıklamayı göster

Cevap: Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group.; Configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

Cevap

Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group, and configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

To allow the Lambda function to reach the ElastiCache cluster, the Lambda function must first be attached to the same VPC. This is done by configuring VPC access on the Lambda function, which deploys ENIs in the specified private subnets. Second, since security groups are stateful and deny all inbound traffic by default, the ElastiCache security group must be updated to allow inbound TCP traffic on the Redis port from the security group associated with the Lambda function.

Adım Adım Çözüm

Enable VPC access for the Lambda function.

The Lambda function is assigned Elastic Network Interfaces (ENIs) in the specified private subnets, enabling it to reach resources inside the VPC.

By default, Lambda functions run in an AWS-managed network that cannot directly communicate with private subnets inside a custom VPC.

Configure the database security group.

The stateful firewall allows incoming network connections from the Lambda function's security group on the specific Redis database port.

Security groups deny all inbound traffic by default, so you must explicitly authorize access from the client's security group.

Anahtar Kavram

To enable secure communication between an AWS Lambda function and an internal VPC resource (like ElastiCache), the Lambda function must be associated with the private subnets of the VPC, and the destination security group must explicitly allow inbound traffic from the Lambda function's security group. Internal VPC communication uses local routes and does not require a NAT Gateway.

Sayfa 1 / 20Sonraki

Security

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram