Several workflows assume the same processing role.
Use CloudTrail to identify which execution read S3.
Which authentication approach is most appropriate?
Set a meaningful role-session name and SourceIdentity and correlate them with CloudTrail events.
Detailed explanation
Lifecycle does not add IAM session identity to API calls.
Lifecycle does not add IAM session identity to API calls.
The execution context remains attached to operations made with temporary credentials.
The execution context remains attached to operations made with temporary credentials.
Individual executions cannot be distinguished during investigation.
Individual executions cannot be distinguished during investigation.
Secrets would leak through listings, logs, and metadata.
Secrets would leak through listings, logs, and metadata.
Check official documentation
Compare the following points with the official documentation.
AWS IAM source identity、role session name、CloudTrail userIdentityの公式説明を確認する。
What to confirm
固定ユーザー名と実行コンテキスト付きセッションの監査差を説明できる。
Key points
- SourceIdentity
- Role session
- CloudTrail
- Correlation
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Audit granularity
Carry execution ID, dataset, and code version so an operation can be reconstructed.
Privacy
Use minimal identifiers and do not put secrets or personal data in session names.