Q77 — AWS SAA-C03 Ch.14

Question 77 of 100 | ← Chapter 14

Q1077. A company wants to provide a third-party system that runs in a private data center with access to its AWS account. The company wants to call AWS APIs directly from the third-party system. The company has an existing process for managing digital certificates. The company does not want to use SAML or OpenID Connect (OIDC) capabilitiesand does not want to store long-term AWS credentials.Which solution will meet these requirements?

Correct Answer: D. Configure AWS Identity and Access Management (IAM) Roles Anywhere to exchange X.509 certificates for AWS credentials to interact with AWS APIs.

Explanation

To meet the requirements of allowing a third-party system in a private data center to call AWS APIs directly without using SAML, OpenID Connect (OIDC), or storing long-term AWS credentials, we should evaluate each option based on its ability to authenticate the third-party system securely:A. Configure mutual TLS to allow authentication of the client and server sides of the communication channel.Mutual TLS (mTLS) ensures that both the client and server authenticate each other using digital certificates. However, AWS APIs do not support mTLS for authentication directly. B. Configure AWS Signature Version 4 to authenticate incoming HTTPS requests to AWS APIs.AWS Signature Version 4 is used to authenticate requests to AWS APIs. However, it typically involves using AWS credentials (Access Key ID and Secret Access Key) to sign the requests, which the company does not want to store.C. Configure Kerberos to exchange tickets for assertions that can be validated by AWS APIs.Kerberos is a network authentication protocol, but AWS APIs do not support Kerberos tickets for authentication.D. Configure AWS Identity and Access Management (IAM) Roles Anywhere to exchange X.509 certificates for AWS credentials to interact with AWS APIs.IAM Roles Anywhere allows a third-party system to use X.509 certificates to request temporary AWS credentials from AWS STS (Security Token Service). These temporary credentials can then be used to sign and authenticate requests to AWS APIs using AWS Signature Version 4. This meets the requirement of not storing long-term AWS credentials and aligns with the company's existing process for managing digital certificates.Conclusion:The correct solution to meet these requirements is:D. Configure AWS Identity and Access Management (IAM) Roles Anywhere to exchange X.509 certificates for AWS credentials to interact with AWS APIs.This solution allows the third-party system to securely authenticate with AWS APIs using temporary credentials obtained via X.509 certificates, adhering to the company's security policies and preferences.