SAP-C02 Question 246
Single answerAn organization is implementing an automated CI/CD pipeline where developers need temporary access to deploy applications onto Amazon ECS. The security team wants to ensure that no long-term credentials are used and that access is granted only when required. Which solution best aligns with these requirements?
- A
Use AWS Secrets Manager to create and store long-term access keys for the developers to access ECS.
- B
Configure an IAM Role with ECS access permissions and use AWS STS to generate temporary credentials for developers.
- C
Create dedicated IAM users for developers and grant them access to ECS using inline policies.
- D
Integrate AWS Cognito to manage developer access to ECS by issuing temporary tokens.
Show answer and explanation
Correct answer: B
Explanation
The best solution is to use an IAM role with ECS permissions and leverage AWS STS to issue temporary credentials when developers need access. This ensures no long-term credentials are used and aligns with the principle of granting least privilege and temporary access only. Other options either fail to meet the requirement for temporary credentials or are designed for different use cases.
- A. Incorrect.
AWS Secrets Manager is used for storing and retrieving secrets like database credentials, API keys, or other sensitive information. It does not facilitate temporary access or credential rotation for this use case.
- B. Correct.
AWS Security Token Service (STS) allows the creation of temporary credentials tied to an IAM role. By configuring an IAM role with the required permissions and using STS, developers can obtain temporary credentials only when needed, meeting the security team's requirements.
- C. Incorrect.
Creating dedicated IAM users with inline policies would result in long-term credentials, which contradicts the security requirement of avoiding persistent access keys.
- D. Incorrect.
AWS Cognito is primarily designed for managing end-user access (e.g., customer-facing applications) and is not suitable for managing developer access to AWS services like ECS.