VCP-CMA 2024 Question 177
Select 2You are tasked with integrating a new cloud account into VMware Aria Automation. The cloud provider is Amazon Web Services (AWS), and the organization requires the ability to provision workloads securely. During the integration process, you are asked to configure specific permissions using the least privilege principle. Which of the following steps should you perform to successfully add the AWS cloud account?
- A
Create an IAM role in AWS with the required permissions and provide the role ARN during the cloud account configuration.
- B
Use an existing IAM user with administrator privileges to connect the AWS cloud account.
- C
Generate an access key and secret key pair for an IAM user with limited permissions and configure them in VMware Aria Automation.
- D
Ensure the IAM role includes permissions to manage EC2 instances, S3 buckets, and other relevant AWS resources.
- E
Configure a service control policy (SCP) in AWS Organizations to restrict access to VMware Aria Automation.
Show answer and explanation
Correct answers: A, D
Explanation
To securely integrate an AWS cloud account into VMware Aria Automation, you should follow the principle of least privilege. Creating an IAM role with the required permissions and providing its ARN ensures secure and scoped access. Additionally, the role must have adequate permissions to manage necessary AWS resources, such as EC2 instances and S3 buckets. Using IAM users or unnecessarily broad permissions can lead to security vulnerabilities, and SCPs are not used during the cloud account integration process.
- A. Correct.
Correct: Creating an IAM role with the required permissions and providing the role ARN is the recommended and secure method to integrate AWS cloud accounts in VMware Aria Automation.
- B. Incorrect.
Incorrect: Using an existing IAM user with administrator privileges violates the principle of least privilege and poses security risks.
- C. Incorrect.
Incorrect: While generating an access key and secret key pair is a valid approach, it is not recommended due to security concerns and best practices favoring the use of IAM roles.
- D. Correct.
Correct: Ensuring the IAM role includes permissions to manage EC2 instances, S3 buckets, and other required AWS resources is necessary for VMware Aria Automation to function properly.
- E. Incorrect.
Incorrect: Configuring a service control policy (SCP) in AWS Organizations is unrelated to the process of adding a cloud account to VMware Aria Automation.