Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

An organization operates a multi-account AWS environment managed under AWS Organizations. An application running on Amazon EC2 instances in a production member account must securely access and decrypt highly confidential financial data stored in an Amazon S3 bucket within a shared services account. The S3 bucket is encrypted with an AWS KMS customer managed key located in the shared services account. The solution must also retrieve database credentials that require rotation every 3030 days.

Which design should a solutions architect implement to meet these security requirements?

  1. Attach an IAM instance profile to the EC2 instances that references an IAM role. Configure the KMS key policy and the S3 bucket policy in the shared services account to grant permissions to the EC2 role. Store the database credentials in AWS Secrets Manager and enable automatic rotation every 3030 days using an AWS Lambda function.Cevap
  2. B
    Use the production account's root user access keys configured in a local credential file on the EC2 instances to access the shared S3 bucket. Store the database credentials in AWS Systems Manager Parameter Store as a Standard parameter, and write a custom script on the EC2 instances to rotate the password every 3030 days using the root credentials.
  3. C
    Create a cross-account IAM role for the EC2 instances. Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to allow EC2 instances to retrieve them, and configure an Amazon EventBridge rule to trigger a Lambda function to update the parameter value every 3030 days.
  4. D
    Attach an IAM role to the EC2 instances with cross-account S3 access. Enable automatic key rotation for the KMS customer managed key in the shared services account, which will immediately re-encrypt all historical S3 data under the new key version, and store the database credentials in Systems Manager Parameter Store as a SecureString.

Cevap

Attach an IAM instance profile to the EC2 instances that references an IAM role, configure cross-account permissions in the shared services account's S3 bucket policy and KMS key policy to trust the role, and store and automatically rotate the credentials in AWS Secrets Manager using a Lambda function.
The correct solution uses an IAM instance profile to assign temporary credentials to the EC2 instances. For cross-account access to S3 and KMS in the shared services account, both the S3 bucket policy and the KMS key policy must trust the EC2 role from the production account. Storing and rotating database credentials every 3030 days is a native capability of AWS Secrets Manager using AWS Lambda, representing the most secure and low-overhead solution.

Adım Adım Çözüm

1
Configure the identity foundation for the EC2 instances using temporary credentials.
Create an IAM role and associate it with an IAM instance profile attached to the EC2 instances, eliminating the need for hardcoded credentials.
This follows the security principle of least privilege and avoids storing long-term credentials on EC2 instances.
2
Establish trust and permissions across AWS accounts.
Update the S3 bucket policy and KMS key policy in the shared services account to grant the required permissions (such as s3:GetObject and kms:Decrypt) to the ARN of the IAM role in the production account.
For cross-account access, both the IAM policy in the source account and the resource policies in the target account must allow the operations.
3
Securely store and automate rotation of the database credentials.
Store the database credentials in AWS Secrets Manager, and configure the built-in rotation mechanism with an AWS Lambda function set to trigger every 3030 days.
AWS Secrets Manager is designed to manage database secrets securely and provides out-of-the-box integration with AWS Lambda to rotate credentials automatically.

Anahtar Kavram

Cross-account resource access using IAM roles combined with secure secrets management and rotation.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru