DOP-C02 practice question: Federation and IAM Identity Center (2 of 2)

Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

An airline's engineering teams deploy services from GitHub Actions workflows into AWS accounts. The current workflows use long-lived access keys stored as GitHub secrets, and the security team has asked for those keys to be removed.

Deployment roles must trust only the approved repository and the main branch, and no access keys may be stored outside AWS. Engineers also need console access that follows their membership in directory groups, which the airline manages in its corporate directory.

Which TWO actions meet these requirements? (Choose two.)

Choose two answers.

A. Create an IAM user for each workflow, store its access key in a secrets manager that the workflows read, and rotate the key every month with a scheduled Lambda function.
B. Create an IAM OIDC identity provider for GitHub, and a deployment role whose trust policy checks the token's subject claim against the approved repository and the main branch.
C. Give every engineer a shared IAM user with console access and an MFA device, and let the engineers record the account in their own password manager.
D. Assign IAM Identity Center permission sets to groups synchronized from the corporate directory, so that each engineer's console access follows the group membership in the directory.
E. Use IAM Roles Anywhere for the workflows, with an X.509 certificate and its private key stored as GitHub secrets, and a trust anchor that maps the certificate to the deployment role.

Show the answer and explanation

Answers: B, D

A. Wrong: Rotated access keys are still long-lived credentials stored outside AWS, which the security team asked to remove. The approach keeps the risk the requirement was meant to eliminate. Learn more: Rotate AWS Secrets Manager secrets (opens in a new tab)
B. Right: Correct. The workflow exchanges a short-lived GitHub OIDC token for temporary role credentials, so no access keys are stored. The trust policy's subject condition limits the role to the approved repository and branch. Learn more: Create a role for OpenID Connect federation (console) (opens in a new tab)
C. Wrong: A shared user removes individual accountability, and it is a long-lived credential. It does not follow the directory groups the airline manages. Learn more: What is IAM Identity Center? (opens in a new tab)
D. Right: Correct. Identity Center federates the directory's groups, so access is granted and removed when group membership changes. Engineers sign in with the corporate identity and receive temporary credentials. Learn more: Manage AWS accounts with permission sets (opens in a new tab)
E. Wrong: Roles Anywhere issues temporary credentials, but the workflow would still store a long-lived private key outside AWS, which the security team does not allow. It also cannot check the repository and branch the way an OIDC subject claim can. Learn more: What is AWS Identity and Access Management Roles Anywhere? (opens in a new tab)

Explanation

An IAM OIDC identity provider for GitHub lets a workflow exchange a short-lived token for role credentials, and a trust policy condition on the token's subject limits which repository and branch can assume the role, so no secrets are stored. Identity Center permission sets assigned to directory groups make console access follow group membership. Stored keys, certificates kept in GitHub and shared users each break a requirement.

DOP-C02 practice question: Federation and IAM Identity Center (2 of 2)

Explanation

Study

Keep practicing