Q41 — AWS SAA-C03 Ch.14

Question 41 of 100 | ← Chapter 14

Q1041. A company has an Amazon S3 bucket that contains sensitive data files. The company has an application that runs on virtual machines in an on-premises data center. The company currently uses AWS IAM Identity Center.The application requires temporary access to files in the S3 bucket. The company wants to grant the application secure access to the files in the S3 bucket.Which solution will meet these requirements?

• A. Create an S3 bucket policy that permits access to the bucket from the public IP address range of the company on-premises data center.
• B. Use IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to the S3 bucket. Configure the virtual machines to assume the role by using the AWS CLI. ✓
• C. Install the AWS CLI on the virtual machine. Configure the AWS CLI with access keys from an IAM user that has access to the bucket.
• D. Create an IAM user and policy that grants access to the bucket. Store the access key and secret key for the IAM user in AWS Secrets Manager. Configure the application to retrieve the access key and secret key at startup.

Correct Answer: B. Use IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to the S3 bucket. Configure the virtual machines to assume the role by using the AWS CLI.

Explanation

To grant temporary and secure access to sensitive data files in an Amazon S3 bucket from an application running on virtual machines in an on-premises data center, the best solution is:B. Use IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to the S3 bucket. Configure the virtual machines to assume the role by using the AWS CLI.Explanation:\1. IAM Roles Anywhere: - IAM Roles Anywhere allows on-premises applications to assume IAM roles and obtain temporary AWS credentials. This provides a secure way to access AWS resources without needing to manage long-lived access keys.\2. Temporary Credentials: - By using roles, the application can obtain temporary security credentials that have the necessary permissions to access the S3 bucket. This approach enhances security by minimizing the risk associated with static credentials.\3. Integration with IAM Identity Center: - Utilizing IAM Identity Center means you can manage access centrally and enforce the principle of least privilege, ensuring that the application has only the permissions it requires.Evaluation of Other Options:A. Create an S3 bucket policy that permits access to the bucket from the public IP address range of the company on-premises data center: - This approach could expose the S3 bucket to potential security risks and is not the most secure method for granting access, as it relies on IP whitelisting, which can be circumvented.C. Install the AWS CLI on the virtual machine. Configure the AWS CLI with access keys from an IAM user that has access to the bucket: - Using static access keys poses a security risk, as these keys can be compromised. Additionally, managing these keys can lead to operational overhead and does not follow best practices for security.D. Create an IAM user and policy that grants access to the bucket. Store the access key and secret key for the IAM user in AWS Secrets Manager: - While this option provides some level of security by using Secrets Manager, it still relies on static credentials. This method does not provide the benefits of temporary credentials and can lead to the same risks as option C.Conclusion:Option B provides the most secure and efficient solution for granting temporary access to the S3 bucket while integrating with existing IAM Identity Center configurations.