Examkin

Soru

Zorluk: KolayIdentity and Access Management (IAM)

A company is deploying an application on Amazon EC2 instances. The application needs to retrieve data from an Amazon DynamoDB table. Which TWO actions should a solutions architect take to configure access to the DynamoDB table in a secure manner? (Select TWO.)

  1. Create an IAM role that has query permissions for the DynamoDB table.Cevap
  2. Create an EC2 instance profile, attach the IAM role to it, and associate it with the EC2 instances.Cevap
  3. C
    Use the AWS account root user credentials directly inside the application configuration file to authenticate requests.
  4. D
    Create an IAM user, generate long-term access keys, and store them in plaintext in a Systems Manager Parameter Store parameter.
  5. E
    Create individual IAM users for the EC2 instances and set up federation via IAM Identity Center to manage instance access.

Cevap

Create an IAM role with query permissions for the DynamoDB table, and associate that role with the EC2 instances using an EC2 instance profile.
Defining permissions in an IAM role and attaching it to the EC2 instances via an instance profile is the secure, standard pattern on AWS. The application uses temporary, auto-rotating credentials from the Instance Metadata Service, which completely avoids storing long-term credentials.

Adım Adım Çözüm

1
Define the IAM role permissions.
An IAM role is created with a policy allowing query operations on the specific DynamoDB table.
This establishes least privilege access for the application's required operations.
2
Attach the role to the EC2 instances.
An EC2 instance profile containing the IAM role is created and associated with the EC2 instances.
This allows the application on EC2 to automatically request temporary security credentials from the Instance Metadata Service (IMDS) without managing hardcoded keys.

Anahtar Kavram

IAM roles for EC2 instances allow applications to securely access AWS resources using temporary credentials rather than long-term keys.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru