Examkin

Soru

Zorluk: Çok zorIdentity and Access Management (IAM)

A security architect is designing an access and credentials management solution for a multi-account AWS environment. An application running on Amazon EC2 instances in Account A (111122223333111122223333) must securely retrieve database credentials to connect to a PostgreSQL database in Account B (444455556666444455556666). The database credentials must be rotated every 3030 days without causing application downtime. The solution must adhere to the principle of least privilege, avoid long-term credentials, and ensure all data in transit and at rest is secured using customer-managed keys (CMKs). Which architecture represents the most secure and compliant design that meets these requirements?

  1. A
    Store the database credentials in Systems Manager Parameter Store as a standard String parameter in Account A. Attach an IAM role to the EC2 instances in Account A to retrieve the parameter value. Configure a scheduled AWS Lambda function in Account B running under administrative root user privileges to update the database password and write the new value back to Parameter Store in Account A.
  2. B
    Create individual IAM users in Account B with long-term access keys for each EC2 instance in Account A. Store these credentials in AWS Secrets Manager in Account B, and write a custom script on the EC2 instances to retrieve the database credentials using the IAM users' access keys, bypassing federation to simplify cross-account authentication.
  3. Store the credentials in AWS Secrets Manager in Account B, encrypted with a customer-managed KMS key. Attach an IAM role to the EC2 instances in Account A, and configure the Secrets Manager resource policy and the KMS key policy in Account B to permit the Account A role to retrieve the secret and decrypt using the KMS key. Configure automatic rotation in Secrets Manager using a Lambda function in Account B.Cevap
  4. D
    Store the credentials in AWS Secrets Manager in Account B. Attach an IAM role to the EC2 instances in Account A and configure the Secrets Manager resource policy to allow access. Enable AWS KMS automatic key rotation on the customer-managed key in Account B, which will automatically rotate the database password and re-encrypt the stored secret on the same schedule.

Cevap

Store the credentials in AWS Secrets Manager in Account B, encrypted with a customer-managed KMS key. Attach an IAM role to the EC2 instances in Account A, and configure the Secrets Manager resource policy and the KMS key policy in Account B to permit the Account A role to retrieve the secret and decrypt using the KMS key. Configure automatic rotation in Secrets Manager using a Lambda function in Account B.
The correct architecture stores credentials securely in AWS Secrets Manager, which supports automated rotation using a Lambda function. Using resource-based policies on the secret and the KMS key in the database account (Account B) allows the IAM role attached to the EC2 instances in Account A to retrieve and decrypt the secret without needing long-term credentials. This adheres to the principles of least privilege and secure cross-account access.

Adım Adım Çözüm

1
Evaluate credential storage and transmission requirements.
Determine that credentials must be stored securely using AWS Secrets Manager in the database account (Account B) rather than Systems Manager Parameter Store in plaintext, and access must be granted using IAM roles rather than long-term IAM user access keys.
This satisfies the requirements for encryption at rest/in transit, avoiding long-term credentials, and practicing least privilege.
2
Configure cross-account access policies for the EC2 instances.
Grant the EC2 instance role in Account A access to Secrets Manager and KMS in Account B. Ensure the Secrets Manager resource policy and the KMS key policy in Account B explicitly permit the role in Account A.
For cross-account access, resource-based policies (and KMS key policies) must trust the external account or role directly since identity-based policies in Account A alone are insufficient.
3
Configure the automated credential rotation mechanism.
Enable Secrets Manager automatic rotation, which uses a Lambda function to update the database password and the secret value.
AWS KMS key rotation only rotates KMS key material, not the actual secret value. Secrets Manager rotation is required to securely update database credentials.

Anahtar Kavram

Cross-account access and credentials rotation utilizing AWS Secrets Manager and AWS KMS with resource-based policies.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru