Topic: DevOps Engineer Professional DOP-C02 topic 1 question 197

A company is refactoring applications to use AWS. The company identifies an internal web application that needs to make Amazon S3 API calls in a specific AWS account.

The company wants to use its existing identity provider (IdP) auth.company.com for authentication. The IdP supports only OpenID Connect (OIDC). A DevOps engineer needs to secure the web application's access to the AWS account.

Which combination of steps will meet these requirements? (Choose three.)

A.
Configure AWS IAM Identity Center (AWS Single Sign-On). Configure an IdP. Upload the IdP metadata from the existing IdP.
B.
Create an IAM IdP by using the provider URL, audience, and signature from the existing IP.
C.
Create an IAM role that has a policy that allows the necessary S3 actions. Configure the role's trust policy to allow the OIDC IP to assume the role if the sts.amazon.com:aud context key is appid_from_idp.
D.
Create an IAM role that has a policy that allows the necessary S3 actions. Configure the role's trust policy to allow the OIDC IP to assume the role if the auth.company.com:aud context key is appid_from_idp.
E.
Configure the web application to use the AssumeRoleWithWebIdentity API operation to retrieve temporary credentials. Use the temporary credentials to make the S3 API calls.
F.
Configure the web application to use the GetFederationToken API operation to retrieve temporary credentials. Use the temporary credentials to make the S3 API calls.

Re: DevOps Engineer Professional DOP-C02 topic 1 question 197

BDE for me

  • dkp
  • New member
  • Offline

Re: DevOps Engineer Professional DOP-C02 topic 1 question 197

DE is correct not sure between A & B
A. Configure AWS IAM Identity Center (AWS Single Sign-On). Configure an IdP. Upload the IdP metadata from the existing IdP.
Pros: Integrates with AWS SSO and allows for IdP metadata upload.
Cons: AWS SSO is generally used for managing multiple AWS accounts and SSO for multiple AWS services, might be overkill for a single account and application.
B. Create an IAM IdP by using the provider URL, audience, and signature from the existing IP.
Pros: Creates a custom IAM IdP using the existing IdP's details.
Cons: Manual configuration of IAM IdP might be error-prone and not the best practice for OIDC integration.

Re: DevOps Engineer Professional DOP-C02 topic 1 question 197

BDE:
A: we need to create an IDP. We dont need a AWS Single Sign-On
B: correct
C: we need to authen. sts.amazon.com:aud does not for authen
D: auth.company.com:aud is for authen
E: This used for authen  AssumeRoleWithWebIdentity
F: This is not used for authen

Re: DevOps Engineer Professional DOP-C02 topic 1 question 197

C & D: Creating an IAM role with specific S3 permissions and configuring the trust policy based on the appropriate audience (sts.amazon.com:aud or auth.company.com:aud) allows secure role assumption by the OIDC IdP on behalf of authenticated users.
E: Using AssumeRoleWithWebIdentity fetches temporary credentials with restricted privileges, enhancing security compared to long-lived credentials.

Re: DevOps Engineer Professional DOP-C02 topic 1 question 197

Options A, B, and F are not suitable for this scenario:
A: AWS SSO is currently not available for public AWS accounts and wouldn't address the specific OIDC integration requirement.
B: While creating an IAM IdP is possible, it's generally less secure than leveraging the existing, trusted IdP with OIDC support.
F: GetFederationToken is often used with SAML-based federation and wouldn't work directly with OIDC.

Re: DevOps Engineer Professional DOP-C02 topic 1 question 197

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html

Re: DevOps Engineer Professional DOP-C02 topic 1 question 197

BDE is my answer

Re: DevOps Engineer Professional DOP-C02 topic 1 question 197

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html