Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is migrating an on-premises database client application to AWS. The application runs on Amazon EC2 instances and requires access to a database on Amazon RDS. Corporate users must be authenticated via their enterprise directory to access the application. The application also needs to retrieve database credentials securely. Which TWO steps should a solutions architect take to implement a secure access and credential management strategy? (Select TWO.)

  1. Create an IAM role with the required permissions for database access, and associate it with the EC2 instances as an instance profile.Cevap
  2. Store the database credentials in AWS Secrets Manager and enable automatic rotation of the secrets.Cevap
  3. C
    Configure the application to use the AWS account root user access keys to ensure uninterrupted administrative connectivity.
  4. D
    Create individual IAM users with long-term access keys for each enterprise directory user to allow direct authentication to the EC2 instances.
  5. E
    Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to simplify retrieval.

Cevap

The solutions architect should associate an IAM role with the EC2 instances as an instance profile and store the database credentials in AWS Secrets Manager with automatic rotation enabled.
Associating an IAM role via an instance profile allows applications running on EC2 instances to securely access database resources using temporary credentials. AWS Secrets Manager securely stores database credentials, encrypts them at rest, and provides native rotation features to automatically update the credentials without manual intervention.

Adım Adım Çözüm

1
Determine the secure method for EC2 instances to access other AWS services.
Identify that using an IAM role via an instance profile allows applications running on EC2 instances to acquire temporary credentials.
This avoids the need to distribute and manage long-term AWS credentials on the EC2 instances, adhering to the principle of least privilege.
2
Select a secure mechanism for storing and rotating database credentials.
Identify AWS Secrets Manager as the appropriate service for storing database credentials, which supports encryption at rest and automated credential rotation.
Secrets Manager helps meet compliance requirements by rotating secrets automatically without service interruption.

Anahtar Kavram

AWS IAM roles for EC2 instances (instance profiles) and AWS Secrets Manager for secure, encrypted credentials storage and automated rotation.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru