DEA-C01 Question 438
Single answerYou are designing a data pipeline in AWS that ingests sensitive customer data into Amazon S3. To ensure secure access, the ingestion application running on an EC2 instance must authenticate with the S3 bucket. The solution must avoid embedding sensitive credentials in the application code and minimize operational overhead. Which authentication method should you choose?
- A
Password-based authentication using AWS Access Keys
- B
Certificate-based authentication using an SSL/TLS certificate
- C
Role-based authentication using an IAM Role assigned to the EC2 instance
- D
Password-based authentication using a custom user database
Show answer and explanation
Correct answer: C
Explanation
Role-based authentication using an IAM Role is the recommended approach for securely authenticating applications running on AWS services such as EC2. By assigning an IAM Role to the EC2 instance, AWS provides temporary credentials to the instance via the Instance Metadata Service, allowing secure and seamless communication with the S3 bucket. This eliminates the need to hard-code sensitive credentials and reduces operational complexity.
- A. Incorrect.
Password-based authentication using AWS Access Keys requires embedding credentials in the application, which poses a security risk and violates the stated requirement to avoid embedding sensitive credentials.
- B. Incorrect.
While SSL/TLS certificates can secure connections, they are not used for authenticating access to AWS resources like S3. This option does not align with the requirements.
- C. Correct.
Role-based authentication using an IAM Role assigned to the EC2 instance is the most secure and operationally efficient method. The EC2 instance can assume the role and gain temporary credentials to access the S3 bucket without embedding sensitive credentials in the application code.
- D. Incorrect.
Password-based authentication using a custom user database is not relevant to accessing AWS resources like S3 and does not fulfill the requirement to minimize operational overhead.