Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

A company is designing a security architecture to grant administrative access to its internal cloud operations team, whose identities are managed in an external corporate directory, and a group of external consultants. The administrators need to configure automatic KMS key rotation for sensitive logs, manage database credentials securely, and perform daily maintenance tasks. Which solution meets these requirements securely and with the least administrative overhead?

  1. A
    Create individual IAM users with long-term access keys in the AWS account for each member of the internal cloud operations team, store the database credentials as standard String parameters in Systems Manager Parameter Store, and enable automatic key rotation on the Customer Managed Key.
  2. Configure AWS IAM Identity Center to federate the internal cloud operations team, create a cross-account IAM role with an External ID for the external consultants, store the database credentials in Systems Manager Parameter Store as SecureString parameters, and enable automatic key rotation on the Customer Managed Key.Cevap
  3. C
    Use the AWS account root user credentials to perform daily maintenance and administrative tasks, store the database credentials in Systems Manager Parameter Store as SecureString parameters, and enable automatic key rotation on the Customer Managed Key.
  4. D
    Configure AWS IAM Identity Center to federate the internal cloud operations team, create a cross-account IAM role with an External ID for the external consultants, store the database credentials in Systems Manager Parameter Store as SecureString parameters, and perform a manual rotation of the Customer Managed Key by deleting the old key material so that all historical data is immediately re-encrypted with the new key version.

Cevap

Configure AWS IAM Identity Center to federate the internal cloud operations team, create a cross-account IAM role with an External ID for the external consultants, store the database credentials in Systems Manager Parameter Store as SecureString parameters, and enable automatic key rotation on the Customer Managed Key.
The correct solution implements federation using AWS IAM Identity Center for internal users, which uses temporary credentials and reduces credential management overhead. It uses a cross-account IAM role with an External ID for third-party access, which aligns with security best practices. It securely stores database credentials in Parameter Store as SecureString parameters (which are encrypted using KMS), and enables automatic key rotation on the Customer Managed Key, preserving the old key material so that existing data remains readable.

Adım Adım Çözüm

1
Evaluate the identity federation requirements for the internal cloud operations team.
AWS IAM Identity Center provides federated access using existing corporate directory credentials, eliminating the need to manage individual IAM users with long-term access keys.
Reduces operational overhead and improves security posture.
2
Determine the access model for the external consultants.
A cross-account IAM role with an External ID is created to grant the external consultants least-privilege, temporary access without creating IAM users in the primary account.
Prevents the 'confused deputy' problem and avoids managing long-term credentials for external entities.
3
Determine the secure storage mechanism for the database credentials.
Systems Manager Parameter Store with SecureString parameters is chosen to encrypt the credentials at rest using KMS.
Ensures sensitive configuration parameters are not stored in plaintext.
4
Determine the key rotation strategy for the Customer Managed Key (CMK).
Enable automatic key rotation on the Customer Managed Key.
AWS KMS automatically rotates the backing key material annually while retaining the old key material to decrypt historical data without manual intervention or key deletion.

Anahtar Kavram

AWS Identity and Access Management (IAM) best practices demand the use of temporary credentials via federation and cross-account roles, secure parameter storage, and proper KMS key rotation mechanics.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru