A customer is deploying an SSL enabled web application to AWS and would like to implement a
separation of roles between the EC2 service administrators that are entitled to login to instances
as well as making API calls and the security officers who will maintain and have exclusive access
to the application’s X.509 certificate that contains the private key.
A.
Upload the certificate on an S3 bucket owned by the security officers and accessible only by EC2
Role of the web servers.
B.
Configure the web servers to retrieve the certificate upon boot from an CloudHSM is managed by
the security officers.
C.
Configure system permissions on the web servers to restrict access to the certificate only to the
authority security officers
D.
Configure IAM policies authorizing access to the certificate store only to the security officers and
terminate SSL on an ELB.
Answer: D
Explanation:
You’ll terminate the SSL at ELB. and the web request will get unencrypted to the EC2 instance, even if the certs are stored in S3, it has to be configured on the web servers or load balancers somehow, which becomes difficult if the keys are stored in S3. However, keeping the keys in the cert store and using IAM to restrict access gives a clear separation of concern between security officers and developers. Developer’s personnel can still configure SSL on ELB without actually handling the keys.
3
1
Correct Answer is : D.
CloudHSM is available to VPC only. And question doesn’t indicate that they are using VPC.
1
0
Though I agree ‘D’ is the best answer here, I do not see the question indicating using `ELB` either.
0
0