Examkin

Soru

Zorluk: Çok zorIdentity and Access Management (IAM)

An enterprise is designing a multi-account strategy using AWS Organizations. An application running on Amazon ECS tasks in the Production Account (Account A) must retrieve database credentials from AWS Secrets Manager in the Security Account (Account B). The secret in Account B is encrypted using a customer managed KMS key. The development team must also be federated into both accounts using their corporate Identity Provider (IdP) to manage these workloads. The architecture must satisfy security audits, enforce automatic rotation of credentials, and adhere to the principle of least privilege. Which combination of actions should the solutions architect take to meet these requirements securely? (Select TWO.)

  1. Configure AWS IAM Identity Center integrated with the corporate SAML 2.0 Identity Provider (IdP) to manage console access, and assign developers to appropriate permission sets in both Account A and Account B.Cevap
  2. Attach an IAM role to the ECS task definition in Account A that grants permissions to retrieve the secret and decrypt with the KMS key. In Account B, update the resource-based policy of the secret and the key policy of the KMS key to permit access from the ECS task IAM role.Cevap
  3. C
    Create individual IAM users in Account B for each developer, and configure the corporate IdP to assume these user identities using AWS Security Token Service (STS) long-term access keys.
  4. D
    Enable automatic key rotation for the customer managed KMS key in Account B, ensuring that all existing Secrets Manager secrets are immediately re-encrypted using the new key version and the older key version is deleted.
  5. E
    Store the database credentials as a plaintext String parameter in Systems Manager Parameter Store in Account A to avoid cross-account KMS decryption and IAM configuration, and allow the ECS task to read this parameter directly.

Cevap

To meet the requirements, the solutions architect should configure AWS IAM Identity Center integrated with the corporate SAML 2.0 Identity Provider (IdP) to manage console access, and attach an IAM role to the ECS task definition in Account A that has permission to retrieve the secret and decrypt using the KMS key, while configuring the resource-based policy of the secret and the KMS key policy in Account B to trust the ECS task role.
The correct solution involves setting up AWS IAM Identity Center for federated single sign-on access to eliminate the need for local IAM users, and establishing cross-account access by combining identity-based policies (ECS task role) in the source account with resource-based policies (the secret and KMS key policies) in the target account.

Adım Adım Çözüm

1
Configure AWS IAM Identity Center integrated with the corporate SAML 2.0 IdP.
Developers can single sign-on to multiple AWS accounts (Account A and Account B) using temporary credentials instead of long-term IAM user access keys.
This satisfies security audits and complies with the best practice of avoiding long-term access credentials.
2
Create an IAM role in Account A, attach permissions to access Secrets Manager and KMS decrypt, and assign this role as the ECS Task Role in the task definition.
The application containers run with the specific IAM identity containing only the permissions required to retrieve the secret.
This adheres to the principle of least privilege by avoiding giving permissions to the ECS container instance profile.
3
Configure resource-based policies in Account B for the Secrets Manager secret and the Customer Managed KMS Key to trust the ECS Task Role ARN from Account A.
The ECS Task in Account A is authorized to read the secret in Account B and decrypt the ciphertext.
Cross-account access requires permissions to be granted on both the identity-based policy (ECS task role) and the resource-based policies (KMS key policy and Secrets Manager secret policy).

Anahtar Kavram

Cross-account access delegation using IAM roles, resource policies, KMS key policies, and IAM Identity Center federation.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru