AWS Certified Security Specialty · Free Practice Question Medium
Question 1
A company has decided to revamp the security for its IT infrastructure and tighten rules for access to AWS resources across the organization. In this context, a Security Engineer has been tasked with creating optimal access credentials/permissions for the company's applications to access the required resources. Some of these applications will run on EC2 instances and need cross-account access privileges for resources present in another AWS account. The company also maintains a few mobile applications that need to access AWS resources.
As an AWS Certified Security Specialist, which of the following would you recommend as the best practices to configure access credentials/permissions for these applications? (Select three)
-
A
Embed access keys with the mobile application and store them in encrypted storage to avoid exposure. As an added layer of security, you can add envelope encryption to the encrypted access keys
-
B
Use access keys to provide long-term credentials to AWS for an application running on Amazon EC2 instance. Encrypt the keys to avoid exposure to the internet. Rotate access keys periodically
-
C
Define an IAM role that has appropriate permissions for the application and launch the Amazon EC2 instance with this role associated with the instance
-
D
Use an IAM role to establish trust between accounts, and then grant users in one account limited permissions to access the trusted account
-
E
Use Amazon Cognito to manage user identities in your mobile application. You can then use the Amazon Cognito credentials provider to manage credentials that your application uses to make requests to access AWS resources
-
F
Create long-term access keys associated with AWS account IAM user and use them to provide access to an application running on EC2 instance. Since the instances run on safe private subnets on AWS Cloud, the long-term credentials are a perfect fit for this scenario with no overhead of creating and maintaining short-term credentials. It is to be noted that long-term access keys should not be associated with the AWS root user account
Reveal correct answers
Correct answers: C, D, E
Explanation
Correct options:
Use an IAM role to establish trust between accounts, and then grant users in one account limited permissions to access the trusted account
Use an IAM role to establish trust between accounts, and then grant users in one account limited permissions to access the trusted account. You share resources in one account with users in a different account. By setting up cross-account access in this way, you don't have to create individual IAM users in each account. In addition, users don't have to sign out of one account and sign into another to access resources in different AWS accounts.
Use Amazon Cognito to manage user identities in your mobile application. You can then use the Amazon Cognito credentials provider to manage credentials that your application uses to make requests to access AWS resources
Don't embed access keys with the app, even in encrypted storage. Instead, use Amazon Cognito to manage user identities in your app. This service lets you authenticate users using Login with Amazon, Facebook, Google, or any OpenID Connect (OIDC)–compatible identity provider. You can then use the Amazon Cognito credentials provider to manage the credentials that your app uses to make requests to access AWS resources.
Define an IAM role that has appropriate permissions for the application and launch the Amazon EC2 instance with this role associated with the instance
Don't use access keys directly in your application. Don't pass access keys to the application, embed them in the application, or let the application read access keys from any source. Instead, define an IAM role that has appropriate permissions for your application and launch the Amazon Elastic Compute Cloud (Amazon EC2) instance with this role associated with the instance. This practice also enables the application to get temporary security credentials that it can, in turn, use to make programmatic calls to AWS. The AWS SDKs and the AWS Command Line Interface (AWS CLI) can get temporary credentials from the role automatically.
Incorrect options:
Create long-term access keys associated with the AWS account IAM user and use them to provide access to an application running on an EC2 instance. Since the instances run on safe private subnets on AWS Cloud, the long-term credentials are a perfect fit for this scenario with no overhead of creating and maintaining short-term credentials. It is to be noted that long-term access keys should not be associated with the AWS root user account
Use access keys to provide long-term credentials to AWS for an application running on an Amazon EC2 instance. Encrypt the keys to avoid exposure to the internet. Rotate access keys periodically
These two options are incorrect from a security standpoint. Long-term access keys, such as those associated with IAM users and AWS account root users, remain valid until you manually revoke them. However, temporary security credentials obtained through IAM roles and other features of the AWS Security Token Service expire after a short period of time. AWS suggests using temporary security credentials to help reduce the risk in case credentials are accidentally exposed.
Embed access keys with the mobile application and store them in encrypted storage to avoid exposure. As an added layer of security, you can add envelope encryption to the encrypted access keys - Don't embed access keys with the app, even in encrypted storage. This is considered a security bad practice.
References:
https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html
https://docs.aws.amazon.com/accounts/latest/reference/credentials-access-keys-best-practices.html
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
