Q62 — AWS SAA-C03 Ch.14

Question 62 of 100 | ← Chapter 14

Q1062. A company has an application that runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a UI that uses Amazon DynamoDB and data services that use Amazon S3 as part of the application deployment.The company must ensure that the EKS Pods for the UI can access only Amazon DynamoDB and that the EKS Pods for the data services can access only Amazon S3. The company uses AWS Identity and Access Management (IAM).Which solution meals these requirements?

• A. Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions.Attach both IAM policies to the EC2 instance profile. Use role-based access control (RBAC) to control access to Amazon S3 or DynamoDB for the respective EKS Pods.
• B. Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions.Attach the Amazon S3 IAM policy directly to the EKS Pods for the data services and the DynamoDB policy to the EKS Pods for the UI.
• C. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role.Attach the AmazonS3FullAccess policy to the data services account and the AmazonDynamoDBFullAccess policy to the UI service account.
• D. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Use IAM Role for Service Accounts (IRSA) to provide access to the EKS Pods for the UI to Amazon S3 and the EKS Pods for the data services to DynamoDB. ✓

Correct Answer: D. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Use IAM Role for Service Accounts (IRSA) to provide access to the EKS Pods for the UI to Amazon S3 and the EKS Pods for the data services to DynamoDB.

Explanation

To ensure that the EKS Pods for the UI can access only Amazon DynamoDB and that the EKS Pods for the data services can access only Amazon S3, the best solution is:D. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Use IAM Role for Service Accounts (IRSA) to provide access to the EKS Pods for the UI to Amazon S3 and the EKS Pods for the data services to DynamoDB.Explanation:\1. Kubernetes Service Accounts: - Creating separate Kubernetes service accounts for the UI and data services allows for fine-grained control over which resources each set of Pods can access.\2. IAM Role for Service Accounts (IRSA): - IRSA enables you to associate IAM roles with Kubernetes service accounts. This allows you to define which AWS resources (like S3 and DynamoDB) the Pods can access based on the role associated with their service account.\3. Fine-Grained Access Control: - By using IRSA, you can ensure that: - The UI Pods can only assume the role that grants access to DynamoDB. - The data services Pods can only assume the role that grants access to S3. - This approach meets the requirement for restricting access to the necessary AWS services while maintaining security best practices.Evaluation of Other Options:A. Attach both IAM policies to the EC2 instance profile: - This would grant access to both services to all Pods running on the EC2 instances, which does not meet the requirement of restricting access to specific AWS services for specific Pods.B. Attach the Amazon S3 IAM policy directly to the EKS Pods: - IAM policies cannot be directly attached to Pods. Instead, they should be managed through service accounts and roles.C. Attach the AmazonS3FullAccess policy to the data services account and the AmazonDynamoDBFullAccess policy to the UI service account: - While this option suggests using service accounts, it incorrectly assigns access roles. The UI Pods should have access to DynamoDB, and the data services Pods should have access to S3, which is the opposite of what is suggested here.Conclusion:Option D provides the most secure and appropriate method for managing access to AWS resources from EKS Pods, ensuring that each service can only access the services it requires while adhering to best practices for IAM and Kubernetes.