Your company has developed a web application using the AWS SDK to access data stored in an Amazon DynamoDB table.
You want to ensure that the API keys for access to DynamoDB are kept secure, and you do not want to write your own sign-in code logic.
Which of the following methods is the most appropriate?
Click on the arrows to vote for the correct answer
A. B. C. D.Answer - C.
With web identity federation, you don't need to create custom sign-in code or manage your own user identities.
Instead, users of your app can sign in using a well-known identity provider (IdP) -such as Login with Amazon, Facebook, Google, or any other OpenID Connect (OIDC)-compatible IdP, receive an authentication token, and then exchange that token for temporary security credentials in AWS that map to an IAM role with permissions to use the resources in your AWS account.
Using an IdP helps you keep your AWS account secure, because you don't have to embed and distribute long-term security credentials with your application.
For more information on Web Identity Federation, please refer to the below document:
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.htmlTo keep API keys for accessing DynamoDB secure, and avoid writing custom sign-in code logic, the most appropriate method is to use web identity federation with IAM roles.
Web identity federation allows users to access AWS resources securely using well-known identity providers (such as Amazon, Google, Facebook, etc.). IAM roles can be assigned to these identities, and temporary security credentials can be obtained to access DynamoDB resources.
Therefore, option C is the most appropriate method to ensure secure access to DynamoDB, while avoiding custom sign-in code. Option A involves creating an IAM user, which may not be suitable for web applications. Option B involves configuring AWS access keys, which can be insecure and difficult to manage. Option D involves storing AWS keys in global variables, which is insecure and can lead to accidental exposure of credentials.
By using web identity federation with IAM roles, temporary credentials can be used to access DynamoDB resources, which are automatically rotated, and can be revoked if necessary. This ensures the security of the application and the DynamoDB resources accessed by it.