Exam AWS Certified SysOps Administrator - Associate topic 1 question 376 discussion

Exam question from Amazon's AWS Certified SysOps Administrator - Associate

Question #: 376
Topic #: 1

[All AWS Certified SysOps Administrator - Associate Questions]

A company has a multi-account environment. Account A has a production application that is hosted on an Amazon EC2 instance. The application needs to query data in an Amazon DynamoDB table that is hosted in Account B.

A SysOps administrator needs to provide the EC2 instance in Account A with access to the DynamoDB table in Account B.

What is the MOST secure solution that will meet these requirements?

A. Update the IAM policy that is attached to the EC2 instance's IAM role to allow the dynamodb:Query permission on the DynamoDB table in Account B. Add a policy in Account A to allow the DynamoDB service principal to use the PassRole action to pass the role to Account B.
B. In Account B, create an IAM role that has permission to query the DynamoDB table. Add the EC2 instance's IAM role to the trust policy on the newly created IAM role in Account Update the IAM policy that is attached to the EC2 instance's IAM role to allow the sts:AssumeRole permission on the newly created IAM role in Account B.
C. Update the IAM policy that is attached to the EC2 instance's IAM role to allow the dynamodb:Query permission on the DynamoDB table in Account B. Update the DynamoDB table's resource policy to allow the query action from the EC2 instance's IAM role.
D. In Account B, create a static IAM key that has the appropriate permissions to query the DynamoDB table. Embed these credentials into the credentials file on the EC2 instance. Reference the credentials every time the application needs to query the table.

Show Suggested Answer

Suggested Answer: B 🗳️

by Tapkar at Aug. 25, 2023, 8:21 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

heshamahammad

3 months, 3 weeks ago

Selected Answer: C

For some AWS services, you can grant cross-account access to your resources using IAM. To do this, you can attach a resource policy directly to the resource that you want to share, or use a role as a proxy. Use a role as a proxy when you want to access resources in another account that do not support resource-based policies. AWS now supoorts dynamodb resource based policies. Check both references in order. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html

upvoted 1 times

...

Salah94

7 months ago

Selected Answer: C

Now DyanmoDB supports resource based policy and hence C is the correct answer https://aws.amazon.com/blogs/database/simplify-cross-account-access-control-with-amazon-dynamodb-using-resource-based-policies/

upvoted 2 times

...

r2c3po

1 year, 1 month ago

Selected Answer: B

This option follows the best practice of using IAM roles and cross-account roles for secure access between AWS accounts. By creating an IAM role in Account B with the necessary permissions to query the DynamoDB table and adding the EC2 instance's IAM role to the trust policy of the newly created role, you establish a secure cross-account access mechanism. The EC2 instance can then assume the role in Account B and access the DynamoDB table securely.

upvoted 4 times

...

AWSdeveloper08

1 year, 5 months ago

Selected Answer: B

Option B describes the most secure solution for granting the EC2 instance in Account A access to the DynamoDB table in Account B:

upvoted 2 times

...

xSohox

1 year, 5 months ago

Selected Answer: B

Looks like correct answer is B. Here is an example with lambda: https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/configure-cross-account-access-to-amazon-dynamodb.html And I couldn't find resource policy on dynamoDB.

upvoted 2 times

...

Tapkar

1 year, 5 months ago

Answer is B. According to https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/configure-cross-account-access-to-amazon-dynamodb.html You should create a role in account B that has permission to query the DynamoDB table. For Select trusted entity, choose account A. Then create a policy in account A to access Account B.

upvoted 2 times

...