Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 197 discussion

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html

BCE https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html

"Use OpenID Connect (OIDC) federated identity providers instead of creating" IAM users." "With an" IdP "you can manage" "user identities outside of AWS and give these external user identities permissions to access AWS resources in your account." B: (YES) "IAM OIDC identity Providers" "This is useful when creating a mobile app or web application that requires access to AWS resources, but you don't want to create custom sign-in code or manage your own user identities." D: (YES) "For OIDC providers, use the fully qualified URL of the OIDC IdP with the aud context key" e.g.: "Condition": {"StringEquals": {"server.example.com:aud": "appid_from_oidc_idp"}}" E: (YES) "AssumeRoleWithWebIdentity" "Federation through a web-based" IDP "returns a set of temporary security credentials for federated users" "authenticated" "with a public identity provider." "This operation is useful for" "client-based web applications that require access to AWS."

BDE for me

DE is correct not sure between A & B A. Configure AWS IAM Identity Center (AWS Single Sign-On). Configure an IdP. Upload the IdP metadata from the existing IdP. Pros: Integrates with AWS SSO and allows for IdP metadata upload. Cons: AWS SSO is generally used for managing multiple AWS accounts and SSO for multiple AWS services, might be overkill for a single account and application. B. Create an IAM IdP by using the provider URL, audience, and signature from the existing IP. Pros: Creates a custom IAM IdP using the existing IdP's details. Cons: Manual configuration of IAM IdP might be error-prone and not the best practice for OIDC integration.

BDE: A: we need to create an IDP. We dont need a AWS Single Sign-On B: correct C: we need to authen. sts.amazon.com:aud does not for authen D: auth.company.com:aud is for authen E: This used for authen AssumeRoleWithWebIdentity F: This is not used for authen

C & D: Creating an IAM role with specific S3 permissions and configuring the trust policy based on the appropriate audience (sts.amazon.com:aud or auth.company.com:aud) allows secure role assumption by the OIDC IdP on behalf of authenticated users. E: Using AssumeRoleWithWebIdentity fetches temporary credentials with restricted privileges, enhancing security compared to long-lived credentials.

BDE is my answer

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html