Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A regional water utility runs control software on 30 Linux servers at pumping stations. The servers are not in AWS. They upload sensor summaries to an Amazon S3 bucket and write alerts to a DynamoDB table, and they can reach AWS public endpoints over HTTPS.
The utility's security standard bans long-term access keys on any server. Each server must have its own identity, so that one compromised server can be revoked without affecting the others. The utility already runs a private certificate authority in AWS Private CA.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Create an IAM user for each server, with a policy that allows only its bucket and table. Store the access keys in a vault on each server, and rotate them every 90 days with a script.
BB. Create a Roles Anywhere trust anchor that trusts the utility's private CA. Issue each server a certificate from that CA, map it to a least-privilege role, and run the Roles Anywhere credential helper on each server.
CC. Enable OpenID Connect federation between each server and IAM, and have each server get a web identity token from its local operating system. Call AssumeRoleWithWebIdentity to receive temporary credentials.
DD. Connect the pumping stations to a VPC with a site-to-site VPN, and attach an instance profile to each server. The servers then receive temporary credentials from the instance metadata service.
Show the answer and explanation
Answer: B
A. Wrong: Each server gets its own identity, but the access keys are long-term credentials, which the standard bans. A rotation script adds upkeep without removing the stored keys from the servers.
B. Right: Correct. Each server authenticates with its own certificate, and Roles Anywhere exchanges it for temporary credentials, so no long-term keys are stored. Revoking one certificate removes only that server's access. Learn more: What is IAM Roles Anywhere? (opens in a new tab)
C. Wrong: Web identity federation needs a token issuer that IAM trusts, and plain servers do not run one. Building and operating that issuer adds an identity system the utility must maintain, which conflicts with the low-overhead requirement.
D. Wrong: Instance profiles are available only to EC2 instances, not to servers outside AWS, even when a VPN connects them. The instance metadata service is also not reachable from the stations, so this approach cannot supply credentials.
Explanation
IAM Roles Anywhere lets workloads outside AWS get temporary credentials with an X.509 certificate that the organization's own CA issues. Per-server certificates give each server its own identity and a simple revocation path. Long-term keys, a custom token issuer, and instance profiles each miss a stated requirement.
Want more on Workload identity outside AWS (IAM Roles Anywhere, OIDC federation)? The 5 full-length practice sets have 6 more Workload identity outside AWS (IAM Roles Anywhere, OIDC federation) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →