Q30 — AWS SAA-C03 Ch.14

Question 30 of 100 | ← Chapter 14

Q1030. A company wants to create an Amazon EMR cluster that multiple teams will use. The company wants to ensure that each team big data workloads can access only the AWS services that each team needs to interact with. The company does not want the workloads to have access to Instance Metadata Service Version 2 (IMDSv2) on the cluster underlying EC2 instances.Which solution will meet these requirements?

Correct Answer: B. Create EMR runtime roles. Configure the cluster to use the runtime roles. Use the runtime roles to submit the big data workloads.

Explanation

To meet the requirements of ensuring that each team can only access the AWS services they need and to prevent access to Instance Metadata Service Version 2 (IMDSv2) on the underlying EC2 instances of an Amazon EMR cluster, the best solution is:B. Create EMR runtime roles. Configure the cluster to use the runtime roles. Use the runtime roles to submit the big data workloads.Explanation:\1. EMR Runtime Roles: - EMR runtime roles allow you to specify fine-grained permissions for each team's jobs running on the EMR cluster. Each team can have its own runtime role with the necessary permissions to access specific AWS services, ensuring that they only have access to the resources they need.\2. Separation of Access: - By using runtime roles, you can effectively manage permissions at the job level, which increases security and ensures compliance with the principle of least privilege.\3. Control Over IMDS Access: - While the runtime roles themselves do not directly control access to the Instance Metadata Service, you can configure the EMR cluster and the IAM roles in a way that minimizes reliance on instance metadata. However, it's important to note that EMR clusters can still access IMDS; controlling the use of IMDS itself may require additional IAM policies or configurations.Evaluation of Other Options:A. Configure interface VPC endpoints for each AWS service that the teams need: - While this option allows secure access to AWS services, it does not provide a way to control team-specific permissions or restrict access to IMDSv2.C. Create an EC2 IAM instance profile that has the required permissions for each team: - Instance profiles apply permissions at the instance level. This means all workloads on the instance would have the same permissions, which does not fulfill the requirement of isolating access by team.D. Create an EMR security configuration that has the EnableApplicationScopedIAMRole option set to false: - While this configuration can restrict the use of application-scoped IAM roles, it does not provide the ability to grant specific permissions to different teams, which is necessary in this scenario.Conclusion:Option B is the most effective solution for ensuring that each team's workloads have access only to the required AWS services while maintaining a modular and secure environment on the Amazon EMR cluster.