Examkin

Soru

Zorluk: KolayIdentity and Access Management (IAM)

A solutions architect is designing a secure architecture for an application running on Amazon EC2 instances. The application needs to retrieve database credentials to connect to an Amazon Aurora database. Which combination of actions should the solutions architect take to grant the application access to the credentials securely? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation.Cevap
  2. Create an IAM role with permissions to access the secret, and attach it to the EC2 instances using an instance profile.Cevap
  3. C
    Store the database credentials as a plaintext String parameter in Systems Manager Parameter Store.
  4. D
    Embed the AWS account root user access keys directly inside the application's configuration file.
  5. E
    Create a dedicated IAM user, generate long-term access keys, and save them in a configuration file on the EC2 instance.

Cevap

Store the database credentials in AWS Secrets Manager and create an IAM role with permissions to access the secret, attaching it to the EC2 instances using an instance profile.
The correct solution involves storing the credentials in AWS Secrets Manager, which secures and automatically rotates the secret, and using an IAM role attached to the EC2 instance profile. This design allows the application to dynamically retrieve temporary credentials to access the secret, satisfying the principle of least privilege and eliminating long-term hardcoded credentials.

Adım Adım Çözüm

1
Store the credentials in AWS Secrets Manager.
The credentials are encrypted at rest and can be rotated automatically.
Securing database credentials prevents unauthorized access and meets security compliance requirements.
2
Create an IAM role that grants access to the specific secret and assign it to the EC2 instance profile.
The application running on the EC2 instances can fetch temporary security credentials automatically.
This avoids hardcoding long-term access keys or using administrative credentials on the instance.

Anahtar Kavram

Applying IAM roles for EC2 instances and using Secrets Manager for secure credential storage.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru