SAP-C02 Question 243
Single answerA financial services company is migrating its on-premises application to AWS. The application requires access to multiple AWS services such as Amazon S3, DynamoDB, and AWS Lambda. The company wants to implement a secure and scalable solution for managing credentials, ensuring that sensitive access keys are not hardcoded into the application or stored on the servers. Which solution should the company implement?
- A
Use IAM roles and attach them to the AWS resources that the application uses.
- B
Embed the AWS access keys in the application code for direct access.
- C
Store AWS access keys in an encrypted file on an EC2 instance and load them at runtime.
- D
Use AWS Secrets Manager to store and retrieve AWS access keys programmatically.
Show answer and explanation
Correct answer: A
Explanation
IAM roles provide a secure, scalable, and automated way to manage credentials for applications running on AWS. They eliminate the need to hardcode or store AWS access keys, as temporary credentials are automatically rotated and assigned to AWS resources. Other options, such as embedding keys in code or storing them on instances, pose significant security risks and are not recommended best practices.
- A. Correct.
IAM roles are the recommended way to securely provide temporary credentials to AWS resources without hardcoding or storing sensitive information. When attached to services like EC2, Lambda, or Fargate, they automatically provide scoped and temporary credentials.
- B. Incorrect.
Embedding AWS access keys in application code is a security anti-pattern because it can lead to exposure if the code is shared or compromised.
- C. Incorrect.
Storing AWS access keys in an encrypted file on an EC2 instance is insecure and adds operational complexity. It is not a scalable or recommended approach for credential management.
- D. Incorrect.
AWS Secrets Manager is designed to securely manage secrets like database credentials or API keys but is not intended for managing AWS access keys. AWS recommends using IAM roles for this purpose.