Task 4.1: Apply authentication mechanisms

• AStore the password as a SecureString parameter in Parameter Store and read it in the job script

  Incorrect

  SecureString encrypts the value, but Parameter Store does not rotate it. AWS recommends Secrets Manager for database credentials.

• BKeep the credentials in a rotated AWS Secrets Manager secret used by the Glue connection

  Correct

  Secrets Manager stores secrets encrypted and rotates them on a schedule, and a Glue connection can read its credentials from a Secrets Manager secret, so the job always gets the current value.

• CEncrypt the password with a KMS key and keep the ciphertext in the job parameters

  Incorrect

  The password is encrypted but never rotated, and every change would mean editing the job.

• DSave the credentials in an SSE-KMS encrypted S3 object that the job reads at start-up

  Incorrect

  The object is encrypted at rest, but nothing rotates the password in the object and the database together.

Database credentials belong in Secrets Manager: encrypted, rotated on a schedule, and fetched at run time by services such as Glue connections.

• ACreate an interface VPC endpoint for S3 in each Availability Zone of the cluster

  Incorrect

  An interface endpoint would also be private, but it is billed for each hour it is provisioned in each Availability Zone.

• BCreate a gateway VPC endpoint for S3 in the private subnets' route tables

  Correct

  A gateway endpoint gives the subnets a route to S3 without an internet gateway or NAT device, and gateway endpoints have no additional charge.

• CAdd a NAT gateway in a public subnet and route the private subnets through it

  Incorrect

  Through a NAT device, traffic to S3 goes out through the internet gateway of the VPC.

• DAdd a bucket policy that denies requests unless aws:SourceVpce equals the endpoint ID

  Correct

  The aws:SourceVpce condition lets a bucket policy restrict access to a specific VPC endpoint.

• ETurn on S3 Transfer Acceleration for the bucket and use its endpoint

  Incorrect

  Transfer Acceleration speeds up transfers over long distances through edge locations. It is a public endpoint, not a private path.

For S3 and DynamoDB, a gateway endpoint is the free private path. Pair it with an aws:SourceVpce condition so the bucket accepts traffic only from that endpoint.

• AIn account A, attach a permissions boundary to the job role that names the bucket

  Incorrect

  A permissions boundary only sets the maximum permissions that identity policies can grant; it grants nothing in another account.

• BIn account B, create a role with read access whose trust policy names the job role in account A

  Correct

  The role in the trusting account defines the originating account as a trusted entity and carries the permissions to read the data.

• CIn account B, create a role whose trust policy names the glue.amazonaws.com principal

  Incorrect

  For cross-account delegation, the role trusts the other account, which is the trusted entity, not a service in account B.

• DIn account A, allow the job role to call sts:AssumeRole on the role in account B

  Correct

  Principals in the trusted account also need permission to assume the role in the other account.

• EIn account B, set S3 Object Ownership on the bucket to bucket owner enforced

  Incorrect

  Object Ownership decides who owns objects and disables ACLs. It does not give account A any access.

Cross-account roles need both sides: a trust policy in the account that owns the data, and permission to assume the role in the account that uses it.

• ASASL/SCRAM with sign-in credentials in Secrets Manager

  Incorrect

  This uses sign-in credentials stored in Secrets Manager, which is the username and password management the team wants to avoid.

• BMutual TLS with certificates from AWS Private CA

  Incorrect

  Mutual TLS needs client certificates from an AWS Private CA, which the team does not want to manage.

• CIAM access control on the MSK cluster

  Correct

  IAM access control handles both authentication and authorization, so MSK checks that a client is an authenticated identity and that it is allowed to produce or consume.

• DSecurity group rules that allow only the ECS tasks

  Incorrect

  Security groups control network traffic. They do not authenticate clients or grant per-topic permissions.

MSK supports IAM, SASL/SCRAM, and mutual TLS; IAM is the option that needs no separate credentials and keeps topic permissions in IAM policies.

• AIAM database authentication with a generated token

  Correct

  With IAM database authentication, the function connects with an authentication token that RDS generates on request instead of a password.

• BA rotated password in AWS Secrets Manager

  Incorrect

  Rotation changes the password, but the password is still stored in a secrets store, which the policy forbids.

• CA password in a KMS-encrypted environment variable

  Incorrect

  Encrypting the variable protects the password, but the function still stores a password, which the policy forbids.

• DA database security group rule that names the function

  Incorrect

  Security groups control which network traffic can reach the database. They do not authenticate a database user.

IAM database authentication replaces stored passwords with short-lived tokens that are signed with the caller's IAM credentials.

• AThe same access keys, rotated every 30 days by a script

  Incorrect

  Rotated access keys are still long-term credentials that must be managed, which is what the company wants to stop.

• BAn EC2 instance profile attached to each on-premises server

  Incorrect

  Instance profiles deliver role credentials to applications on Amazon EC2 instances, not to servers outside AWS.

• CA bucket policy that allows uploads from the data center's IP range

  Incorrect

  A bucket policy can restrict access, but the scripts would still need credentials to sign their requests.

• DIAM Roles Anywhere with the company's certificate authority

  Correct

  Roles Anywhere gives workloads outside AWS temporary credentials for IAM roles, using X.509 certificates, so there are no long-term keys to manage.

Inside AWS, roles reach code through instance profiles and execution roles; outside AWS, Roles Anywhere exchanges certificates for the same temporary role credentials.

• ABucket policies on the approved buckets that require this endpoint

  Incorrect

  Such bucket policies control who can reach the approved buckets. They do not stop the jobs from writing to other buckets.

• BA security group outbound rule that allows only the S3 prefix list

  Incorrect

  Security groups control traffic to and from resources. The prefix list covers Amazon S3 as a whole, not individual buckets.

• CA route table entry for the endpoint in each private subnet only

  Incorrect

  The route sends S3 traffic through the gateway endpoint. Without an endpoint policy, the default policy allows access through it.

• DAn endpoint policy that allows access only to the approved buckets

  Correct

  An endpoint policy is a resource-based policy on the endpoint that controls access to Amazon S3 through it, and it can limit that access to specific buckets.

Endpoint policies govern what can be reached through the endpoint; bucket policies govern who can reach a bucket. Exfiltration controls need the endpoint side.