Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 14
Tommy has written an AWS Lambda function that will perform certain tasks for the organization when data has been uploaded to an S3 bucket. Security policies for the organization do not allow Tommy to hardcode any type of credential within the Lambda code or environment variables. However, Tommy needs to retrieve a credential from Vault to write data to an on-premises database.
What auth method should Tommy use in Vault to meet the requirements while not violating security policies?
-
A
AppRole
-
B
Token
-
C
AWS
-
D
Userpass
Reveal correct answer
Correct answer: C
Explanation
The aws auth method provides an automated mechanism to retrieve a Vault token for IAM principals and AWS EC2 instances. Unlike most Vault auth methods, this method does not require manual first-deploying or provisioning security-sensitive credentials (tokens, username/password, client certificates, etc), by operators under many circumstances.
https://developer.hashicorp.com/vault/docs/auth/aws#aws-auth-method
A. The AppRole auth method in Vault is used for machine-to-machine authentication, which would still require storing credentials within the Lambda code or environment variables, not meeting the security policy requirements.
B. The Token auth method in Vault requires generating and managing tokens manually, which could potentially violate the security policy of not hardcoding any credentials in the Lambda function.
C. Using the AWS auth method in Vault allows Tommy to authenticate using AWS IAM credentials without hardcoding any credentials in the Lambda function or environment variables, meeting the security policy requirements.
D. The Userpass auth method in Vault is used for username and password authentication, which would require Tommy to store credentials within the Lambda code or environment variables, violating the security policy.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
