Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is developing a hybrid cloud application. A component of the application runs on a physical server in the company's on-premises data center and requires programmatic access to write transaction logs to an Amazon DynamoDB table. To comply with security standards, the application must not use long-term AWS credentials, and access must be secured using the company's existing on-premises public key infrastructure (PKI). Which solution meets these requirements with the least operational overhead?

  1. Configure AWS IAM Roles Anywhere. Establish a trust anchor using the on-premises Certificate Authority (CA) and associate it with an IAM role that has write permissions to the DynamoDB table. Configure the on-premises application to exchange its X.509 digital certificate for temporary AWS credentials.Cevap
  2. B
    Create an AWS account root user access key. Store the root access key ID and secret access key in a secured configuration file on the on-premises server, and configure the application to load these credentials at startup.
  3. C
    Create a dedicated IAM user with programmatic access and attach an IAM policy allowing write access to the DynamoDB table. Generate long-term access keys for this user and hardcode them directly into the application's configuration file.
  4. D
    Create a dedicated IAM user with DynamoDB write permissions. Store the generated IAM access key and secret key as a plaintext String parameter in AWS Systems Manager Parameter Store, and configure the application to retrieve it via an API call.

Cevap

Configure AWS IAM Roles Anywhere by establishing a trust anchor with the on-premises Certificate Authority (CA), associating it with an IAM role, and exchanging X.509 digital certificates for temporary AWS credentials.
The correct solution uses AWS IAM Roles Anywhere to extend IAM role capabilities to workloads outside of AWS. By setting up a trust anchor with the on-premises Certificate Authority (CA), the on-premises application can exchange its X.509 certificate for temporary, short-lived AWS credentials. This avoids the use of long-term credentials and utilizes the existing PKI infrastructure.

Adım Adım Çözüm

1
Establish trust with the on-premises environment.
Create a trust anchor in AWS IAM Roles Anywhere using the company's existing Certificate Authority (CA) certificate.
This establishes a cryptographic trust relationship between AWS IAM Roles Anywhere and the on-premises PKI.
2
Define permissions and trust relationships.
Create an IAM role with write permissions to the DynamoDB table, and define a trust policy that allows the IAM Roles Anywhere service principal (rolesanywhere.amazonaws.com) to assume the role.
This ensures the temporary credentials obtained will have the correct permissions and that IAM Roles Anywhere is authorized to assume the role.
3
Associate the role with a profile and request credentials.
Create an IAM Roles Anywhere profile containing the IAM role. Configure the on-premises application to use the credential helper tool to sign requests with its X.509 certificate and request temporary credentials.
This dynamically generates short-lived IAM credentials for the application without storing any long-term AWS access keys on-premises.

Anahtar Kavram

AWS IAM Roles Anywhere enables on-premises workloads to securely obtain temporary AWS credentials using local digital certificates (X.509) instead of using long-term IAM access keys, aligning with security best practices.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru