DEA-C01 Question 437
Select 2You are designing a data pipeline on AWS to process sensitive customer information. The pipeline uses Amazon Redshift for data storage and AWS Glue for ETL operations. To ensure secure authentication, you want to avoid storing long-term credentials. Which authentication methods should you consider to meet this requirement?
- A
Password-based authentication with IAM user credentials
- B
Certificate-based authentication using SSL/TLS certificates
- C
Role-based authentication using AWS IAM roles
- D
Federated authentication using AWS Single Sign-On (SSO)
Show answer and explanation
Correct answers: C, D
Explanation
To meet the requirement of avoiding long-term credential storage, you should use authentication methods that rely on temporary credentials or external identity providers. Role-based authentication via AWS IAM roles uses temporary credentials issued by STS, while federated authentication via AWS SSO allows integration with external identity providers to provide temporary, secure access. Password-based and certificate-based methods involve managing long-term credentials, which does not meet the stated security requirement.
- A. Incorrect.
Password-based authentication with IAM user credentials involves storing long-term credentials, which contradicts the requirement to avoid storing them.
- B. Incorrect.
Certificate-based authentication using SSL/TLS certificates provides secure communication but still requires management of certificate credentials, which could be considered a form of long-term credential storage.
- C. Correct.
Role-based authentication using AWS IAM roles allows temporary credentials to be issued via the AWS Security Token Service (STS), aligning with the requirement to avoid storing long-term credentials.
- D. Correct.
Federated authentication using AWS Single Sign-On (SSO) enables you to leverage external identity providers, avoiding the need for long-term credentials and supporting secure, temporary access.