Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is setting up a new multi-account AWS environment. The security team wants to establish a secure administrative access strategy for its systems administrators and migrate database credentials currently hardcoded in application configuration files. The solution must enforce the principle of least privilege, eliminate long-term credentials for daily management, and automatically rotate database passwords. Which TWO options should the solutions architect recommend to meet these requirements? (Select TWO.)

  1. Configure AWS IAM Identity Center to federate access from the company's identity provider and assign administrative roles using permission sets.Cevap
  2. Use AWS Secrets Manager to store the database credentials and enable automatic rotation.Cevap
  3. C
    Create individual IAM users with long-term access keys in the AWS accounts for the administrators to use during daily operations.
  4. D
    Configure the AWS account root user credentials and distribute them among the systems administrators for standard administrative tasks.
  5. E
    Store the database credentials as plaintext Standard String parameters in AWS Systems Manager Parameter Store and enable KMS key rotation.

Cevap

To secure administrative access and database credentials, the company must implement federated access using AWS IAM Identity Center and store the database credentials in AWS Secrets Manager with automatic rotation enabled.
Implementing federated access through AWS IAM Identity Center ensures that systems administrators use short-term credentials, fulfilling the security requirement to eliminate long-term keys. Storing credentials in AWS Secrets Manager allows the organization to systematically rotate the database passwords automatically without code changes.

Adım Adım Çözüm

1
Federate administrative access.
By using AWS IAM Identity Center mapped to the corporate identity provider, administrators obtain temporary security credentials instead of relying on long-term keys.
This minimizes the credential exposure window and satisfies the requirement to eliminate long-term access keys.
2
Secure database passwords and configure lifecycles.
Moving hardcoded database passwords to AWS Secrets Manager protects them at rest and in transit.
Secrets Manager provides native capabilities to automatically rotate these passwords at scheduled intervals, satisfying compliance requirements.

Anahtar Kavram

Federated identity management and automated secrets lifecycle rotation under least privilege principles.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru