SCS-C02 Question 294
Single answerA company wants to create a secure mechanism for developers to access AWS resources temporarily without hardcoding credentials in applications. The developers require access to an S3 bucket and DynamoDB for a specific project. Which approach ensures secure access while adhering to AWS best practices for temporary credentialing?
- A
Create an IAM user for each developer with programmatic access keys and store the keys securely in the application code.
- B
Use AWS STS to assume a role that provides temporary credentials and assign that role the necessary permissions for S3 and DynamoDB.
- C
Create an IAM user with long-term access keys and rotate the keys every 90 days.
- D
Use AWS Cognito Identity Pools to generate temporary credentials for developers to access S3 and DynamoDB.
Show answer and explanation
Correct answer: B
Explanation
AWS STS (Security Token Service) is the recommended mechanism for providing temporary credentials to developers. By using STS to assume a role, developers can securely access AWS resources without the need to manage long-term credentials. This aligns with AWS best practices for security and credential management.
- A. Incorrect.
Hardcoding credentials in application code is a security risk and violates AWS best practices. This approach is not recommended.
- B. Correct.
AWS STS (Security Token Service) is designed to provide temporary credentials that are secure and limited in scope and duration. By assuming a role with the required permissions, developers can access resources without hardcoding credentials.
- C. Incorrect.
Using long-term access keys introduces the risk of credential exposure. While key rotation mitigates this risk, it does not eliminate it, and temporary credentials are preferred for such use cases.
- D. Incorrect.
AWS Cognito Identity Pools are typically used for federated access for end-users rather than for backend developers or applications. This option is not suitable for the given scenario.