CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Access Control in AWS for Financial Applications
Explore a key AWS exam question on access control for financial applications. Learn the right choices and why they matter.
Designing secure architectures for financial applications can be tricky. Candidates often stumble when determining the best AWS services for access control. This question tests your understanding of what ensures sensitive data is protected from unauthorized access.
The question
Your team is designing an architecture for a financial application that requires strict compliance with data protection regulations. You need to ensure that only authorized users can access sensitive data. Which AWS services should you implement to enforce access control?
- A. AWS Identity and Access Management (IAM) for user permissions and Amazon RDS for database access.
- B. AWS Key Management Service (KMS) for encryption and AWS CloudTrail for logging access.
- C. Amazon S3 bucket policies and AWS Shield for DDoS protection.
- D. AWS Secrets Manager for credential management and Amazon Cognito for user authentication.
Think before you scroll
Before making a selection, consider what access control means. Focus on services that directly manage who can access sensitive data. Look for solutions that align with compliance requirements for financial applications.
The answer
The correct options are A and D. Both provide effective mechanisms for managing user access and permissions. IAM allows you to set fine-grained access policies, while Cognito manages user authentication efficiently.
Why the other options lose
- Option B: While KMS encrypts data and CloudTrail logs access, neither directly enforces user access control. They serve important roles in security but do not manage permissions.
- Option C: S3 bucket policies can control access to objects, but AWS Shield protects against DDoS attacks. This combination does not focus on user authorization, making it less relevant for the question.
The concept behind it
The principle of access control in cloud environments relies on identity management and user authentication. AWS IAM is fundamental for defining user permissions, while services like Cognito help manage user identities securely. Understanding how these services interact is crucial for compliance, especially in financial applications.
Exam trap to remember
Always prioritize identity and access management services when asked about securing sensitive data. Remember: Focus on who can access what.