DEA-C01 Question 416
Select 3A company is designing a data ingestion pipeline using Amazon Kinesis Data Streams to process sensitive customer data in real-time. The security team requires that all interactions with the Kinesis Data Streams be authenticated to prevent unauthorized access. Which of the following mechanisms should the company implement to ensure secure authentication for the Kinesis Data Streams?
- A
Use AWS Identity and Access Management (IAM) policies to control access to the Kinesis Data Streams.
- B
Embed an AWS access key and secret key directly in the application code for authentication.
- C
Enable server-side encryption with AWS Key Management Service (KMS) for the Kinesis Data Streams.
- D
Use an IAM Role with temporary security credentials via AWS Security Token Service (STS) for the application accessing the Kinesis Data Streams.
- E
Authenticate using resource-based policies attached to the Kinesis Data Streams.
Show answer and explanation
Correct answers: A, D, E
Explanation
To securely authenticate access to Kinesis Data Streams, it is crucial to leverage mechanisms provided by AWS such as IAM policies, IAM roles with temporary credentials, and resource-based policies. These mechanisms ensure that only authorized users or applications can interact with the streams while minimizing the risk of credential exposure. Embedding keys in application code is insecure, and encryption mechanisms like server-side encryption do not directly address authentication.
- A. Correct.
IAM policies are a secure and scalable way to control access to AWS resources, including Kinesis Data Streams. They allow you to define permissions for users, roles, and groups.
- B. Incorrect.
Embedding access keys directly in the application code is not secure because it increases the risk of unauthorized access if the keys are exposed or leaked.
- C. Incorrect.
While server-side encryption with AWS KMS enhances data security, it does not directly handle authentication. It is a mechanism for encrypting data at rest, not controlling access to the resource.
- D. Correct.
Using an IAM Role with temporary credentials via AWS STS is a secure method of providing applications access to AWS resources. Temporary credentials reduce the risk of long-term key exposure.
- E. Correct.
Resource-based policies allow you to define permissions directly on the Kinesis Data Streams, enabling granular control over who can access the resource.