Topic 1 Question 1017
A company has an application that runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a UI that uses Amazon DynamoDB and data services that use Amazon S3 as part of the application deployment.
The company must ensure that the EKS Pods for the UI can access only Amazon DynamoDB and that the EKS Pods for the data services can access only Amazon S3. The company uses AWS Identity and Access Management (IAM).
Which solution meals these requirements?
Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach both IAM policies to the EC2 instance profile. Use role-based access control (RBAC) to control access to Amazon S3 or DynamoDB for the respective EKS Pods.
Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach the Amazon S3 IAM policy directly to the EKS Pods for the data services and the DynamoDB policy to the EKS Pods for the UI.
Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Attach the AmazonS3FullAccess policy to the data services account and the AmazonDynamoDBFullAccess policy to the UI service account.
Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Use IAM Role for Service Accounts (IRSA) to provide access to the EKS Pods for the UI to Amazon S3 and the EKS Pods for the data services to DynamoDB.
ユーザの投票
コメント(8)
- 正解だと思う選択肢: D👍 8jingen112024/10/18
- 正解だと思う選択肢: C
D is sneakily WRONG because it swaps the services incorrectly. Pay attention. UWC.
👍 4BugsyWarribwoy2025/01/08 - 正解だと思う選択肢: C
A - This is a major security flaw. All Pods running on the EC2 instances would inherit both the S3 and DynamoDB permissions. B - Directly attaching IAM policies to Pods is not a valid AWS mechanism. You should use roles. C - Not recommended unless we throw least privilege principles to the wind. BUT this is the only feasible option here, so. D - This option mixes up the permissions. It gives UI Pods access to S3 and data service Pods access to DynamoDB, which is the OPPOSITE of the requirement.
👍 4LeonSauveterre2025/01/10
シャッフルモード