Crucial Exams

AWS Certified Solutions Architect Professional SAP-C02 Practice Question

A financial-services company is modernizing a monolithic application into a set of microservices running on Amazon EKS. Several of the new microservices, running in separate pods, require access to different AWS services, including Amazon S3 buckets and Amazon DynamoDB tables. The company's security policy strictly prohibits the use of long-lived IAM user access keys within applications or on the underlying compute instances. The solution must provide granular, pod-level permissions and adhere to the principle of least privilege.

Which approach should a solutions architect recommend to meet these requirements in the most secure and scalable manner?

  • Configure IAM Roles for Service Accounts (IRSA), creating a unique IAM role for each microservice's permission set and associating each role with the corresponding Kubernetes service account.

  • Create distinct IAM users for each microservice, generate long-lived access keys, and store these keys as Kubernetes Secrets. Mount the secrets into the respective pods as environment variables.

  • Create a single IAM role that contains all necessary permissions for all microservices and attach this role to the EC2 instance profile used by the EKS worker nodes.

  • Install and configure an open-source tool, such as kube2iam or kiam, on the EKS cluster to intercept metadata API calls and associate IAM roles with pods based on annotations.

AWS Certified Solutions Architect Professional SAP-C02
Accelerate Workload Migration and Modernization
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot