Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

A company is designing a secure architecture for an application running on Amazon EC2 instances. The application needs to retrieve data from an Amazon RDS database and store reports in an Amazon S3 bucket. The security policy mandates that:

1. The EC2 instances must use short-term credentials to access the S3 bucket.
2. The database credentials must be rotated every 30 days without downtime.
3. The AWS KMS Customer Managed Key (CMK) used to encrypt S3 reports must be rotated annually without interrupting access to historical reports.

Which combination of actions should the company perform to meet these requirements? (Select TWO.)

  1. Attach an IAM role to the EC2 instances to grant S3 permissions, and use AWS Secrets Manager to store and automatically rotate the database credentials every 30 days.Cevap
  2. Enable automatic annual rotation for the KMS Customer Managed Key, which creates a new backing key version for new writes while keeping old versions available for decryption.Cevap
  3. C
    Create an IAM user, store the long-term credentials in a configuration file on the EC2 instances, and store the database credentials as plaintext parameters in Systems Manager Parameter Store.
  4. D
    Enable automatic key rotation for the KMS key, and execute a custom script to immediately decrypt and re-encrypt all existing S3 reports with the new key version.
  5. E
    Log in to the AWS account root user to configure the database credentials in AWS Secrets Manager and to manually trigger the annual rotation of the KMS key.

Cevap

The correct options are the ones suggesting to attach an IAM role to the EC2 instances and store database credentials in AWS Secrets Manager, and to enable automatic annual rotation for the KMS Customer Managed Key.
Attaching an IAM role to the EC2 instances allows them to retrieve temporary credentials to access the S3 bucket safely. AWS Secrets Manager can store database credentials and rotate them automatically without downtime. Enabling automatic annual key rotation on KMS Customer Managed Keys manages the backing keys seamlessly: it uses the new backing key for encryption, while keeping older backing key versions available to decrypt historical data without needing manual re-encryption or application updates.

Adım Adım Çözüm

1
Address the requirement for secure, temporary credentials for the EC2 instances.
Attach an IAM role to the EC2 instances instead of using long-term IAM user access keys.
IAM roles utilize AWS Security Token Service (STS) to provide temporary security credentials, reducing credential leakage risks.
2
Address the requirement for database credential storage and automated rotation.
Use AWS Secrets Manager to store credentials and configure a 30-day automatic rotation schedule.
AWS Secrets Manager natively integrates with RDS to rotate credentials using Lambda without application downtime.
3
Address the requirement for KMS Customer Managed Key rotation.
Enable automatic annual rotation for the customer managed key.
Automatic KMS key rotation generates a new backing key for encryption while preserving older backing key versions for seamless decryption of historical data, requiring no manual re-encryption.

Anahtar Kavram

AWS Identity and Access Management (IAM) Roles, Secrets Manager rotation integration, and AWS KMS automatic key rotation mechanics.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru