Question

A healthcare company runs an on-premises data processing application that needs to call Amazon SageMaker inference endpoints in AWS. The security team requires that no long-term AWS access keys be stored on the on-premises servers, and that all access use temporary credentials tied to the servers' existing X.509 certificates issued by the company's private certificate authority. Which approach best meets these requirements?

Accepted Answer

Configure IAM Roles Anywhere with a trust anchor referencing the company's certificate authority, so the servers exchange their X.509 certificates for temporary IAM role credentials.

Answer

Create an IAM user for the application and store its access key and secret key in a configuration file on each on-premises server.

Answer

Embed a hardcoded IAM role ARN in the application and rely on the SageMaker endpoint's resource policy to authorize the on-premises servers by IP address.

Answer

Generate long-term access keys for a shared IAM role and rotate them manually every 90 days using a scheduled script.