DEA-C01 Question 436
Single answerA company uses Amazon Redshift to store analytical data and has a requirement to securely allow a third-party application to access the Redshift cluster for data analysis. The third-party application should not store or manage any long-term credentials. Which authentication method would best meet this requirement?
- A
Password-based authentication using Amazon Redshift database credentials
- B
Certificate-based authentication using SSL/TLS certificates
- C
Role-based authentication by using an IAM role with Amazon Redshift
- D
Publicly exposing the Redshift endpoint and using IP whitelisting for security
Show answer and explanation
Correct answer: C
Explanation
Using IAM roles for authentication fulfills the requirement of avoiding the storage and management of long-term credentials. By assigning a role to the third-party application, you can allow it to assume the role and obtain temporary credentials for securely accessing the Amazon Redshift cluster.
- A. Incorrect.
Password-based authentication requires the third-party application to store and manage database credentials, which violates the requirement of not storing long-term credentials.
- B. Incorrect.
Certificate-based authentication typically secures the communication channel but does not eliminate the need for the third party to store credentials for accessing Redshift.
- C. Correct.
Role-based authentication allows the third-party application to assume an IAM role, leveraging temporary security credentials to access Redshift without storing long-term credentials. This meets the requirement effectively.
- D. Incorrect.
Publicly exposing the Redshift endpoint and using IP whitelisting is insecure and does not address the need for avoiding the storage of long-term credentials.