Problem
An AWS customer is deploying an application that is composed of an AutoScalingGroup of EC2 instances. The customer’s security policy requires that every outbound connection from these instances to any other services within the customer’s VPC must be authenticated using X.509 certificate that contains the specific instance-id.
In addition, all X.509 certificates must be signed by the customer’s key management service in order to be trusted for authentication.
Which of the following configurations will support these requirements?
A. Configure an IAM Role that grants access to an Amazon S3 object containing a signed certificate and configure the AutoScalingGroup to launch instances with the role. Have the instances bootstrap get the certificate from Amazon S3 upon first boot.
B. Configure the Auto Scaling Group to send an SNS notification of the launch of a new instance to the trusted key management service. Have the key management service generate a signed certificate and send it directly to the newly launched instance.
C. Embed a certificate into the Amazon Machine Image that is used by the Auto Scaling Group. Have the launched instances generate a certificate signature request with the instance’s assigned instance-id to the key management service for signature.
D. Configure the launched instances to generate a new certificate upon first boot. Have the key management service poll the AutoScalingGroup for associated instances and send new instances a certificate signature that contains the specific instance-id.
Answer: B
Explanation
A. Newly launched instances should have their own certificates that are specific to their own instance-id. But in this case, S3 has a certificate that has been signed already without considering any specific instance-id.
B. This solution can satisfy all requirements such as instance-id specific certificate.
C. Just like case A, an embedded certificate cannot have a specific instance-id in itself.
D. In this case, instances should generate certificates by themselves, not leaving it to the customer key management service.
