Examkin

Soru

Zorluk: Çok zorIdentity and Access Management (IAM)

An enterprise runs a microservices-based application on Amazon ECS in Account B. The application requires read access to sensitive customer data files stored in an Amazon S3 bucket within Account A. The S3 bucket is encrypted using an AWS KMS customer managed key (CMK) in Account A. A solutions architect must design a secure, cross-account access pattern following the principle of least privilege, ensuring that credentials are not hardcoded or stored insecurely. Which combination of configurations must the solutions architect implement to achieve this goal? (Select TWO.)

  1. Create an IAM task role in Account B with permissions to read from the S3 bucket and decrypt using the KMS key, and associate it with the ECS task definition.Cevap
  2. Configure both the S3 bucket policy and the KMS key policy in Account A to explicitly grant the ECS task role in Account B permissions for read and decrypt actions.Cevap
  3. C
    Grant access by adding the AWS account root user of Account B to the S3 bucket policy in Account A, and configure the ECS tasks to run with the root user credentials.
  4. D
    Generate an IAM user in Account A, attach a policy allowing read and decrypt permissions, and store the access key and secret key as standard parameters in Systems Manager Parameter Store for the ECS task to retrieve.
  5. E
    Enable KMS automatic key rotation in Account A to automatically re-encrypt existing objects in the S3 bucket and implicitly delegate cross-account decryption rights to Account B.

Cevap

Creating an IAM task role in Account B associated with the ECS task definition, and configuring the S3 bucket policy and KMS key policy in Account A to grant permissions to that role.
To establish secure cross-account access, the solutions architect must assign an IAM task role directly to the ECS container. Additionally, because the S3 bucket and KMS CMK are in Account A (cross-account relative to the ECS task in Account B), the resource-based policies in Account A (the bucket policy and KMS key policy) must explicitly authorize the ECS task role from Account B.

Adım Adım Çözüm

1
Define an IAM task role in the application's account (Account B) with a trust policy allowing the ECS task executor to assume the role.
An IAM role is created that can be assumed by ECS containers at launch.
Allows containerized tasks to dynamically obtain temporary security credentials instead of relying on long-term IAM user keys.
2
Associate the newly created IAM task role with the ECS task definition.
The ECS container receives local environment variables with temporary AWS credentials.
Permits the application code inside the container to make authenticated AWS API calls under the identity of the task role.
3
Modify the S3 bucket policy in Account A to allow read permissions for the IAM task role's ARN in Account B.
Cross-account S3 access is authorized at the resource level.
Cross-account access to S3 requires explicit authorization from both the IAM identity policy and the target resource's bucket policy.
4
Update the KMS key policy in Account A to allow decrypt permissions for the IAM task role's ARN in Account B.
Cross-account KMS decrypt authorization is established.
Because the S3 objects are encrypted with a Customer Managed Key, the reader must have explicit decrypt permissions on the key policy; IAM policies alone cannot grant access to cross-account KMS keys.

Anahtar Kavram

Cross-account resource delegation using IAM roles, S3 bucket policies, and KMS key policies.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru