You have just developed a new mobile application that handles analytics workloads on large-scale datasets stored on Amazon Redshift. Consequently, the application needs to access Amazon Redshift tables. Your company is asking to expand the scope of the application. Which of the following methods would be the best, both practically and security-wise, to access the tables? Choose the correct answer from the options below.

Answer options:

A.Create an IAM user and generate encryption keys for that user. Create a policy for Redshift read-only access. Embed the keys in the application.
B.Create an HSM client certificate in Redshift and authenticate using this certificate.
C.Create a Redshift read-only access policy in IAM and embed those credentials in the application.
D.Use roles that allow a web identity federated user to assume a role that allows access to the Redshift table by providing temporary credentials.

Answer – D
Tip: When a service, user, or application needs to access an AWS resource, always prefer creating an IAM Role over creating an IAM User.
Option A is incorrect because embedding keys in the application to access AWS resources is not a good architectural practice as it creates security concerns.
Option B is incorrect because the Redshift cluster uses the HSM certificate to connect to the client`s HSM to store and retrieve the keys used to encrypt the cluster databases.
Option C is incorrect because the read-only policy is insufficient and embedding keys in the application to access AWS resource is not a good architectural practice as it creates security concerns.
Option D is CORRECT because (a) IAM role allows the least privileged access to the AWS resource, (b) web identity federation ensures the identity of the user, and (c) the user is given temporary credentials to access the AWS resource.
For more information on IAM policies, please refer to the below link-
http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html
For more information on web identity federation, please refer to the below link-
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html