Exam AWS Certified Solutions Architect - Professional topic 1 question 476 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 476
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A large company has many business units. Each business unit has multiple AWS accounts for different purposes. The CIO of the company sees that each business unit has data that would be useful to share with other parts of the company. In total, there are about 10 PB of data that needs to be shared with users in
1,000 AWS accounts. The data is proprietary, so some of it should only be available to users with specific job types. Some of the data is used for throughput of intensive workloads, such as simulations. The number of accounts changes frequently because of new initiatives, acquisitions, and divestitures.
A Solutions Architect has been asked to design a system that will allow for sharing data for use in AWS with all of the employees in the company.
Which approach will allow for secure data sharing in scalable way?

A. Store the data in a single Amazon S3 bucket. Create an IAM role for every combination of job type and business unit that allows for appropriate read/write access based on object prefixes in the S3 bucket. The roles should have trust policies that allow the business unit's AWS accounts to assume their roles. Use IAM in each business unit's AWS account to prevent them from assuming roles for a different job type. Users get credentials to access the data by using AssumeRole from their business unit's AWS account. Users can then use those credentials with an S3 client.
B. Store the data in a single Amazon S3 bucket. Write a bucket policy that uses conditions to grant read and write access where appropriate, based on each user's business unit and job type. Determine the business unit with the AWS account accessing the bucket and the job type with a prefix in the IAM user's name. Users can access data by using IAM credentials from their business unit's AWS account with an S3 client.
C. Store the data in a series of Amazon S3 buckets. Create an application running in Amazon EC2 that is integrated with the company's identity provider (IdP) that authenticates users and allows them to download or upload data through the application. The application uses the business unit and job type information in the IdP to control what users can upload and download through the application. The users can access the data through the application's API.
D. Store the data in a series of Amazon S3 buckets. Create an AWS STS token vending machine that is integrated with the company's identity provider (IdP). When a user logs in, have the token vending machine attach an IAM policy that assumes the role that limits the user's access and/or upload only the data the user is authorized to access. Users can get credentials by authenticating to the token vending machine's website or API and then use those credentials with an S3 client.

Show Suggested Answer

Suggested Answer: D 🗳️

by awsec2 at Sept. 23, 2019, 7:57 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Smart

Highly Voted 3 years, 9 months ago

I am gonna go with D. I just don't feel comfortable with putting all kinds of data in a single bucket. With options A & B, there is going to be lot of editing of IAM Roles & Bucket policy as add or remove more accounts. Option C is good but what about auditability at CloudTrail if application API is used for data access. At this business level, AD or AWS SSO is must.

upvoted 24 times

SD13

3 years, 8 months ago

Token vending machine can be single point of failure.. Going with C

upvoted 2 times

pixepe

2 years, 8 months ago

TVM can be implemented with LAMBDA - https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/implement-saas-tenant-isolation-for-amazon-s3-by-using-an-aws-lambda-token-vending-machine.html So Option D is not single point of failure

upvoted 1 times

...

donathon

Highly Voted 3 years, 9 months ago

B A: Not scalable. Remember this company has 1000 accounts. C: How would users be easily access the files using the application’s API? D: STS are used for web based identity like Google or Facebook and not used for IDP. https://aws.amazon.com/blogs/mobile/simplifying-token-vending-machine-deployment-with-aws-cloudformation/

upvoted 14 times

Konnon

3 years, 9 months ago

With SAML, STS can work with IdP. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html

upvoted 8 times

...

directconnect

3 years, 9 months ago

I will go with D. A,B store the data in a single S3 bucket. Note that the questions says petabytes of data. A single S3 bucket can only store 5 terabytes of data, so a series of buckets will be needed.

upvoted 2 times

Japs

3 years, 8 months ago

A bucket can contain unlimited amounts of data

upvoted 4 times

...

SadioMane

3 years, 8 months ago

The total volume of data and number of objects you can store are unlimited. Individual Amazon S3 objects can range in size from a minimum of 0 bytes to a maximum of 5 terabytes.

upvoted 3 times

...