A company runs an application on premises. The application needs to periodically upload large files to an Amazon S3 bucket. A solutions architect needs a solution to provide the application with…

Question

Options

• ACreate an IAM user that has an access key and a secret key. Store the keys on the on-premises
• BConfigure an AWS Site-to-Site VPN connection from the on-premises environment to the
• CConfigure an S3 bucket policy to allow access for the on-premises server's public IP address.
• DConfigure a trust relationship between the on-premises server and AWS Security Token Service

• A
  5% (1)
• C
  10% (2)
• D
  86% (18)

Explanation

The best practice to securely provide short-term access to AWS resources, such as Amazon S3, without using long-term credentials, is to use AWS Security Token Service (STS). According to the AWS IAM Best Practices and the Security Pillar of the AWS Well-Architected Framework, temporary credentials should always be used over long-term credentials when possible. "Use temporary credentials (IAM roles and AWS STS) instead of long-term access keys. Temporary security credentials are short-term, automatically expire, and are retrieved using AWS Option D outlines the use of a trust relationship and assume-role mechanism via AWS STS. This allows the on-premises application to request temporary, scoped-down credentials to upload files to S3 securely. This approach is: Secure - Uses short-lived credentials with least privilege Scalable - No need for EC2 or VPN tunnels Low Operational Overhead - No infrastructure to maintain AWS-Recommended - Aligned with security best practices Option A uses long-term credentials, which is a security risk. Option B requires additional infrastructure (EC2, VPN), increasing complexity and cost. Option C relies on IP-based access, which is insecure and not a form of identity-based

No community discussion yet for this question.