Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is designing a secure architecture for a reporting application that runs on Amazon EC2 instances in a private subnet. The application must retrieve a database password that is updated every 30 days. Additionally, developers who are managed in an external corporate directory need administrative access to manage these EC2 instances. The company's security policy prohibits the use of long-term credentials or hardcoded secrets.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center to federate the external directory, allowing developers to access AWS using temporary credentials associated with an administrative role.Cevap
  2. Attach an IAM role to the EC2 instances using an instance profile, and configure the application to retrieve the database password dynamically from AWS Secrets Manager.Cevap
  3. C
    Create individual IAM users with long-term access keys for each developer in the AWS account, allowing them to authenticate directly.
  4. D
    Use the AWS account root user access keys on the EC2 instances to ensure administrative permissions are available for standard tasks.
  5. E
    Store the database password as a plaintext String parameter in Systems Manager Parameter Store, and enable AWS KMS key rotation to automatically update the password value.

Cevap

The solutions architect should recommend configuring AWS IAM Identity Center for directory federation and using an IAM role on the EC2 instances alongside AWS Secrets Manager for database password retrieval.
Configuring AWS IAM Identity Center enables secure, centralized identity federation with the external corporate directory, providing developers with short-term credentials via IAM roles. Associating an IAM role with the EC2 instances allows them to assume permissions securely without embedded credentials, and AWS Secrets Manager securely stores and automatically rotates the database password.

Adım Adım Çözüm

1
Configure identity federation for developer access.
Developers use temporary credentials via AWS IAM Identity Center.
Secures access for external directory users without the need for long-term IAM access keys.
2
Configure EC2 instance profiles and IAM roles.
The application on the EC2 instances automatically receives temporary security credentials.
Eliminates the need to store hardcoded AWS credentials on the instances.
3
Store sensitive database credentials in AWS Secrets Manager.
Secrets are encrypted at rest and can be rotated automatically every 30 days.
Secures the database password and meets the rotation requirement seamlessly.

Anahtar Kavram

IAM role-based access, identity federation, and secure secrets management.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru