Q11 — AWS SAA-C03 Ch.14

Question 11 of 100 | ← Chapter 14

Q1011. A company is using an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company must ensure that Kubernetes service accounts in the EKS cluster have secure and granular access to specific AWS resources by using IAM roles for service accounts (IRSA).Which combination of solutions will meet these requirements? (Choose two.)

• A. Create an IAM policy that defines the required permissions Attach the policy directly to the IAM role of the EKS nodes.
• B. Implement network policies within the EKS cluster to prevent Kubernetes service accounts from accessing specific AWS services.
• C. Modify the EKS cluster's IAM role to include permissions for each Kubernetes service account. Ensure a one-to-one mapping between IAM roles and Kubernetes roles.
• D. Define an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon ResourceName (ARN) of the IAM role. ✓
• E. Set up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider. ✓

Correct Answer: D. Define an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon ResourceName (ARN) of the IAM role., E. Set up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider.

Explanation

To ensure that Kubernetes service accounts in an Amazon EKS cluster have secure and granular access to specific AWS resources using IAM roles for service accounts (IRSA), the best combination of solutions is:D. Define an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon Resource Name (ARN) of the IAM role.E. Set up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider.Explanation of Each Step:\1. D. Define an IAM role that includes the necessary permissions: - This role should define the specific AWS permissions needed for the Kubernetes service accounts. Annotating the service accounts with the IAM role's ARN allows Kubernetes to use this role when accessing AWS resources, ensuring that access is controlled and specific to the service account's needs.\2. E. Set up a trust relationship between the IAM roles and an OpenID Connect (OIDC) identity provider: - This step is crucial for enabling the service accounts to assume the IAM role. By configuring the trust relationship, you allow the EKS cluster to authenticate the service accounts against the OIDC provider, which is automatically set up when you create an EKS cluster. This is a core part of the IRSA functionality.Evaluation of Other Options:A. Create an IAM policy that defines the required permissions and attach the policy directly to the IAM role of the EKS nodes: - This approach is not recommended because it grants permissions to the entire node and not to specific service accounts. This could lead to excessive permissions and a violation of the principle of least privilege.B. Implement network policies within the EKS cluster: - While network policies can control traffic between pods, they do not manage IAM permissions or access to AWS resources. Thus, they are not relevant for configuring IRSA.C. Modify the EKS cluster's IAM role to include permissions for each Kubernetes service account: - This method does not align with the IRSA model, which allows for more granular access control through IAM roles directly associated with service accounts rather than the EKS cluster's IAM role.Conclusion:By selecting D and E, you ensure that your Kubernetes service accounts in the EKS cluster have secure, granular access to AWS resources via IAM roles for service accounts, adhering to best practices for security and access management.