AWS Certified Solutions Architect - Professional SAP-C02 — Topic 1 Question 459

Question

A company is using GitHub Actions to run a CI/CD pipeline that accesses resources on AWS. The company has an IAM user that uses a secret key in the pipeline to authenticate to AWS. An existing IAM role with an attached policy grants the required permissions to deploy resources. The company’s security team implements a new requirement that pipelines can no longer use long-lived secret keys. A solutions architect must replace the secret key with a short-lived solution. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

Correct answer: B. The correct answer is B. Option B: Create an IAM OpenID Connect (OIDC) identity provider (IdP) in AWS Identity and Access Management (IAM). Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRoleWithWebIdentity API call f... An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

AWS Certified Solutions Architect - Professional SAP-C02 — Question 459