Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

An enterprise has an on-premises data processing application that runs on physical servers in a local data center. The application needs to upload large volumes of processed transaction logs to an Amazon S3 bucket in the company's AWS production account. The company's security policy strictly prohibits the use of long-term credentials, such as IAM access keys, stored on local servers. A solutions architect must design a secure authentication and authorization mechanism for this application. Which combination of actions will meet these requirements? (Select TWO.)

  1. Configure AWS Identity and Access Management (IAM) Roles Anywhere by establishing a trust anchor with an on-premises Certificate Authority (CA).Cevap
  2. Create an IAM role with a trust policy that allows the IAM Roles Anywhere service principal to assume the role, and attach the necessary permissions for Amazon S3.Cevap
  3. C
    Create a dedicated IAM user, generate AWS access keys, and configure the on-premises application to retrieve the access keys dynamically from an AWS Systems Manager Parameter Store parameter of type String.
  4. D
    Generate an AWS access key pair for the AWS account root user to allow the on-premises application uninterrupted administrative access to the Amazon S3 bucket.
  5. E
    Create a permanent IAM user in the AWS account for each physical server, generate long-term access keys, and use identity federation to rotate the keys daily.

Cevap

Establish a trust anchor using an on-premises Certificate Authority (CA) in AWS IAM Roles Anywhere, and create an IAM role trusting the IAM Roles Anywhere service principal with the necessary Amazon S3 permissions.
The correct strategy relies on AWS IAM Roles Anywhere. First, establishing a trust anchor with the company's Certificate Authority allows IAM Roles Anywhere to authenticate local servers using digital certificates. Second, creating an IAM role that trusts the IAM Roles Anywhere service principal allows the authenticated servers to acquire temporary security credentials to write to the Amazon S3 bucket, meeting all requirements without storing long-term credentials.

Adım Adım Çözüm

1
Select a mechanism to authenticate non-AWS workloads securely without static credentials.
Identify AWS IAM Roles Anywhere as the ideal solution to issue short-term AWS credentials to on-premises servers using public key infrastructure (PKI).
IAM Roles Anywhere eliminates the security risks associated with storing long-term credentials on local physical servers.
2
Establish trust between the local CA and AWS.
Create a trust anchor in IAM Roles Anywhere pointing to the on-premises Certificate Authority (CA).
This allows AWS to verify the identity of the physical servers when they present their certificates signed by the local CA.
3
Authorize the authenticated servers to write to Amazon S3.
Configure an IAM role with a trust policy allowing the service principal 'rolesanywhere.amazonaws.com' to assume the role, and attach the required S3 bucket policies or permissions.
When the servers successfully authenticate, IAM Roles Anywhere will return temporary credentials by assuming this role.

Anahtar Kavram

AWS IAM Roles Anywhere enables on-premises workloads to obtain temporary security credentials using X.509 digital certificates, eliminating the need to store long-term IAM access keys on local hardware.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru