DOP-C02 Question 358
Select 3Your company has implemented an application that runs on Amazon EC2 instances within an Auto Scaling group. The application interacts with an Amazon S3 bucket to upload and retrieve files. Developers need to perform application deployments to the EC2 instances, but they should not have direct access to the S3 bucket. Additionally, the EC2 instances must only be allowed to access the specific S3 bucket, and no other AWS resources. How should you configure IAM entities to meet these requirements?
- A
Create an IAM role with a policy granting access to the specific S3 bucket and attach it to the EC2 instances.
- B
Create an IAM user for the application with a policy granting access to the specific S3 bucket and store the user's credentials on the EC2 instances.
- C
Attach an identity-based policy to the IAM users in the development team that denies access to the S3 bucket and only allows deployment tasks.
- D
Configure a resource-based policy on the S3 bucket to allow access from the EC2 instances by their IAM role.
- E
Use an identity provider to federate developer access and restrict their permissions using session policies.
Show answer and explanation
Correct answers: A, D, E
Explanation
To meet the requirements, the EC2 instances should use an IAM role to securely access the S3 bucket without storing credentials, and a resource-based policy on the S3 bucket can explicitly allow access from the EC2 instances' IAM role. For developers, federated access with session policies ensures secure and temporary access for deployment tasks, adhering to the principle of least privilege. This configuration aligns with AWS best practices for managing human and machine access using IAM entities.
- A. Correct.
Correct: Using an IAM role for the EC2 instances is the appropriate approach for granting machine (application) access to the S3 bucket. This avoids storing long-term credentials on the instances and ensures the instances assume the role with temporary credentials.
- B. Incorrect.
Incorrect: Storing IAM user credentials on EC2 instances is not a best practice because it creates a security risk by using long-term credentials. Roles should be used for machine access instead.
- C. Incorrect.
Incorrect: Denying access to the S3 bucket for developers and allowing deployment tasks is unnecessary in this scenario because access to the S3 bucket is already restricted to the application running on EC2 instances. This approach does not meet the requirements effectively.
- D. Correct.
Correct: A resource-based policy on the S3 bucket can be used to explicitly allow access from the EC2 instances' IAM role, providing fine-grained access control.
- E. Correct.
Correct: Federating developer access through an identity provider enables secure, temporary access for deployment activities. Session policies can further restrict their permissions to only allow deployment tasks, ensuring least privilege.