Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company is deploying a containerized application on Amazon EC2 instances. The application requires access to an Amazon DynamoDB table to retrieve configuration settings. The developer proposes creating a new IAM user, generating long-term access keys, and embedding them in the application's configuration file. Which solution should a solutions architect recommend to establish secure access while adhering to the principle of least privilege?

  1. Create an IAM role with a permissions policy that allows access to the DynamoDB table, attach this role to the EC2 instances using an instance profile, and configure the application to use the AWS SDK to retrieve temporary credentials automatically.Cevap
  2. B
    Create an IAM user with the required DynamoDB permissions, store the access keys in Systems Manager Parameter Store as a plaintext String parameter, and configure the application to retrieve these credentials at startup.
  3. C
    Create a standard String parameter in Systems Manager Parameter Store containing the AWS account root user's access keys, and configure the EC2 instances to retrieve these credentials at startup.
  4. D
    Create individual IAM users for each EC2 instance, and configure a SAML 2.0 identity provider to dynamically federate these user credentials for database access.

Cevap

Create an IAM role with a permissions policy that allows access to the DynamoDB table, attach this role to the EC2 instances using an instance profile, and configure the application to use the AWS SDK to retrieve temporary credentials automatically.
The correct solution uses an IAM role attached to the EC2 instances via an instance profile. This is the recommended security best practice because it eliminates the need to manage, store, or rotate long-term AWS credentials. The AWS SDK running inside the EC2 instances automatically retrieves temporary security credentials from the Instance Metadata Service (IMDS) to perform the authorized actions on DynamoDB.

Adım Adım Çözüm

1
Define an IAM policy outlining the least privilege permissions required to access the target DynamoDB table.
An IAM policy document specifying permissions for DynamoDB actions.
Ensures the application has only the necessary access permissions.
2
Create an IAM role and attach the DynamoDB permissions policy to it.
An IAM role configured with the specific permissions.
Allows AWS resources or services to assume the identity and use the permissions of this role.
3
Attach the IAM role to the EC2 instances using an EC2 instance profile.
The EC2 instances now have access to retrieve security credentials for the assumed IAM role via the Instance Metadata Service (IMDS).
Enables the application to fetch temporary credentials automatically through the AWS SDK without hardcoding keys.

Anahtar Kavram

EC2 Instance Profiles and IAM Roles
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru