A company has an application running on Amazon EC2 instances in AWS Account A (Development) that requires read-only access to an Amazon DynamoDB table located in AWS Account B (Production). According to security best practices, the application must not store long-term credentials on the EC2 instances. Which combination of actions should the solutions architect take to configure this access securely? (Select TWO.)
- Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and attach a permissions policy that grants read-only access to the DynamoDB table.Cevap
- Configure an IAM role in Account A, attach it to the EC2 instances as an instance profile, and authorize the role to perform the sts:AssumeRole action on the Account B role.Cevap
- CCreate access keys for the AWS account root user of Account B, and configure the application to retrieve them using instance metadata.
- DCreate an IAM user in Account B, and configure the application to retrieve the user's access keys from a plaintext Systems Manager Parameter Store parameter of type String.
- ECreate individual IAM users in Account B for the EC2 instances in Account A to use for federated access to the DynamoDB table.
Cevap
Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and configure an IAM role in Account A attached to the EC2 instances to authorize the sts:AssumeRole action on the Account B role.
The correct architecture uses cross-account role delegation. A role in Account B defines a trust relationship allowing Account A to assume it and carries the permission to read the DynamoDB table. The EC2 instances in Account A are assigned an instance profile with an IAM role that permits calling the sts:AssumeRole API on the role in Account B. This removes the need for long-term credentials on the instances.
Adım Adım Çözüm
Anahtar Kavram
Cross-account IAM role assumption and delegate trust pattern
Tahmini Süre:2m 0s