Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

A company is designing a secure identity and access management architecture. The company has a multi-account AWS environment managed under AWS Organizations. The engineering team consists of 150 developers whose identities are managed in an on-premises Active Directory (AD). Additionally, an on-premises application server requires access to an Amazon S3 bucket located in a production AWS account to write daily backup files. The security team mandates that no long-term AWS credentials should be stored on-premises, and administrative overhead must be minimized.

Which combination of actions will meet these requirements securely? (Select TWO.)

  1. Configure AWS IAM Identity Center (successor to AWS Single Sign-On) to federate with the on-premises Active Directory, and map AD groups to permission sets in the AWS accounts.Cevap
  2. Set up AWS IAM Roles Anywhere, establish trust with the company's private Certificate Authority (CA), and configure the on-premises application server to exchange its X.509 certificate for temporary IAM credentials.Cevap
  3. C
    Create individual IAM users in each AWS account for all 150 developers, and implement an automation script to periodically synchronize user passwords from the on-premises Active Directory.
  4. D
    Generate an access key pair for the AWS Organizations management account root user, and configure the on-premises application server to use these credentials for writing backup files to the S3 bucket.
  5. E
    Create an IAM user with S3 write permissions, generate an access key, store the key in AWS Systems Manager Parameter Store as a Standard String parameter type, and configure the on-premises application to retrieve the parameter.

Cevap

Configure AWS IAM Identity Center to federate with the on-premises Active Directory and map groups to permission sets, and set up AWS IAM Roles Anywhere to allow the on-premises application server to exchange its X.509 certificate for temporary credentials.
The correct solution uses AWS IAM Identity Center to federate on-premises Active Directory identities, enabling centralized single sign-on access to multiple AWS accounts. For the on-premises application server, AWS IAM Roles Anywhere is the secure and modern architectural pattern to obtain temporary IAM credentials using X.509 certificates, completely eliminating the need to configure or store long-term access keys on-premises.

Adım Adım Çözüm

1
Establish centralized federation for the developer accounts.
AWS IAM Identity Center is configured to federate with the on-premises Active Directory, mapping AD groups directly to target permission sets in the member accounts.
This centralizes user management, minimizes administrative overhead, and avoids creating individual IAM users in each target AWS account.
2
Secure programmatic access for the on-premises workload without long-term credentials.
AWS IAM Roles Anywhere is configured to trust the company's private Certificate Authority (CA) and maps the server's certificate to an IAM role with S3 write permissions.
This allows the server to authenticate via an X.509 certificate and receive short-term session credentials, avoiding the risk of stored access keys.

Anahtar Kavram

AWS Identity and Access Management best practices dictate using federation via AWS IAM Identity Center for human access, and AWS IAM Roles Anywhere for secure machine access from outside AWS without long-term credentials.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru