CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate Exam Question Walkthrough
Explore a question on providing temporary AWS credentials to on-premises applications. Learn why the right choice matters.
What is the recommended way to provide an on-premises application with temporary AWS credentials rather than long-lived IAM user keys?
Options:
A. Embed IAM user access keys in the app config
B. Use IAM Roles Anywhere with X.509 certificates to obtain temporary credentials
C. Share the root credentials over VPN
D. Create a public S3 bucket for credential exchange
Think before you scroll
Consider the implications of using long-lived IAM user keys versus temporary credentials. Temporary credentials enhance security by limiting the lifespan of access and reducing the risk of exposure.
The answer
B. Use IAM Roles Anywhere with X.509 certificates to obtain temporary credentials is the correct option. This method allows on-premises applications to request short-lived AWS credentials securely, avoiding the risks associated with long-lived IAM user keys.
Why the other options lose
A. Embed IAM user access keys in the app config: This approach is insecure. Hardcoding IAM user access keys can lead to accidental exposure and increased risk if the application is compromised or shared.
C. Share the root credentials over VPN: This option is highly discouraged. Root credentials should never be shared or used for day-to-day operations. Using root access increases the risk of unintentional changes or exposure of sensitive resources.
D. Create a public S3 bucket for credential exchange: This method is risky. A public S3 bucket can be accessed by anyone, leading to potential credential theft and security issues. Credentials should never be stored in publicly accessible locations.
The concept behind it
The key principle here is the use of temporary security credentials. Temporary credentials reduce the risk associated with long-lived keys. AWS IAM Roles Anywhere allows on-premises applications to obtain these credentials securely via X.509 certificates, ensuring that only authorized applications can access resources.
Exam trap to remember
When dealing with credentials, remember: Always prefer temporary credentials over long-lived keys to enhance security and minimize risk.