Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is designing a secure web application that will run on Amazon EC2 instances in a private subnet. The application needs to retrieve database credentials and encrypt sensitive files before storing them in an Amazon S3 bucket. The security policy mandates that database credentials must be rotated every 30 days, the encryption keys must be rotated annually, and the EC2 instances must access these resources securely using temporary credentials. Which TWO actions should the solutions architect take to meet these requirements?

  1. Create an IAM role with permissions to retrieve the credentials and decrypt with the AWS KMS key, associate the role with an EC2 instance profile, and attach it to the EC2 instances.Cevap
  2. Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the customer managed KMS key.Cevap
  3. C
    Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store, and write a custom script to rotate the parameter.
  4. D
    Use the AWS account root user access keys stored locally on the EC2 instances to perform standard application decryption and database connection tasks.
  5. E
    Configure the customer managed KMS key to immediately re-encrypt all historical S3 data under the new key version when a rotation occurs.

Cevap

To meet the security requirements, the solutions architect should store the database credentials in AWS Secrets Manager with automatic rotation, enable annual key rotation for the customer managed KMS key, and use an IAM role associated with an EC2 instance profile to grant the EC2 instances secure access to those resources.
The correct solution involves storing the credentials in AWS Secrets Manager and enabling automatic 30-day rotation, enabling automatic annual key rotation for the customer managed KMS key, and creating an IAM role attached to an EC2 instance profile to provide temporary credentials to the instances. This configuration ensures credentials and keys are rotated securely, and the EC2 instances access resources without hardcoded credentials.

Adım Adım Çözüm

1
Configure secure credential management and key rotation.
Store the database credentials in Secrets Manager with a 30-day rotation schedule, and enable automatic annual rotation on the KMS key.
This satisfies the operational requirement to periodically rotate secrets and keys automatically.
2
Provide secure access to EC2 instances using IAM roles.
Create an IAM role with policy permissions to retrieve the secret and decrypt using the KMS key, associate it with an instance profile, and attach it to the EC2 instances.
This allows the application to authenticate using temporary security credentials rather than hardcoded long-term credentials.

Anahtar Kavram

Secure credential management, encryption key rotation, and IAM role association for EC2 instances.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru