CLF-C02 Question 106
Single answerAn organization needs to grant an application running on an EC2 instance access to read files from an S3 bucket. The organization's security policy requires that permissions only be granted based on the principle of least privilege. Which approach should the organization use to meet these requirements?
- A
Create an IAM user with full S3 access, generate access keys, and store them on the EC2 instance.
- B
Attach a custom IAM policy to the EC2 instance's IAM role that grants read-only access to the specific S3 bucket.
- C
Use a managed policy with full S3 access and attach it to the EC2 instance's IAM role.
- D
Grant public read permissions on the S3 bucket so the EC2 instance can access it without additional IAM configurations.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege requires granting only the minimum permissions necessary to perform a task. In this scenario, attaching a custom IAM policy to the EC2 instance's IAM role with read-only access to the specific S3 bucket ensures that the permissions are tightly scoped and secure. Other options either grant excessive permissions or compromise security, making them unsuitable.
- A. Incorrect.
Storing access keys on the EC2 instance violates security best practices and does not adhere to the principle of least privilege, as it grants unnecessary access and poses a security risk.
- B. Correct.
Attaching a custom IAM policy to the EC2 instance's IAM role with specific read-only access to the required S3 bucket ensures permissions are limited to only what is necessary, adhering to the principle of least privilege.
- C. Incorrect.
Using a managed policy with full S3 access grants excessive permissions that are not needed for the task, violating the principle of least privilege.
- D. Incorrect.
Granting public read permissions on the S3 bucket introduces significant security risks by making the bucket accessible to anyone on the internet, violating both security best practices and the principle of least privilege.