Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

A company is designing a mobile application that allows authenticated external users to upload profile documents directly to a shared Amazon S3 bucket. The application authenticates users via an external OpenID Connect (OIDC) compliant identity provider. The architecture must strictly prevent the storage of long-term credentials on the mobile devices, enforce the principle of least privilege, and avoid manual administrative overhead for user provisioning. Which TWO actions should a solutions architect take to meet these security requirements? (Select TWO).

  1. Configure an OIDC-compatible identity provider in AWS IAM, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action.Cevap
  2. Implement dynamic access control by using policy variables in the IAM role's permissions policy to restrict S3 prefix access to the user's OIDC unique identifier.Cevap
  3. C
    Create a dedicated IAM user with long-term credentials for each external application user and distribute these credentials to the mobile devices.
  4. D
    Store a master administrative IAM user's credentials in AWS Systems Manager Parameter Store as a standard plaintext parameter for the mobile application to retrieve.
  5. E
    Enable automatic key rotation on the Customer Managed KMS Key used for S3 encryption, which will immediately re-encrypt all historical user files under the new key version.

Cevap

The solutions architect should configure an OIDC-compatible identity provider in AWS IAM, create an IAM role with a trust policy that allows the web identity federation action, and implement dynamic access control by using policy variables to restrict S3 prefix access.
To support external authentication via an OIDC provider without creating IAM users, we use web identity federation. Registering the OIDC provider in IAM and creating an IAM role with a trust policy for the web identity action allows users to exchange their OIDC token for temporary AWS credentials. By applying an IAM policy with dynamic policy variables, we restrict users to their own S3 prefix without manually managing unique policies for each user.

Adım Adım Çözüm

1
Register the OIDC provider.
Establish a trust relationship between AWS IAM and the external OIDC identity provider.
Allows AWS to accept authentication assertions from the external provider.
2
Create an IAM role with AssumeRoleWithWebIdentity trust policy.
Generate a role that authenticated mobile app users can assume dynamically.
Eliminates the need for long-term AWS credentials on mobile devices by using temporary security tokens.
3
Define dynamic policies with policy variables.
Apply a resource-level restriction using OIDC-specific claims in the policy.
Enforces folder isolation within the S3 bucket dynamically, preventing users from accessing other users' prefixes.

Anahtar Kavram

AWS web identity federation allows OIDC authenticated users to obtain temporary credentials to access AWS resources like Amazon S3, using policy variables to enforce least-privilege folder boundaries dynamically.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru