DVA-C02 Question 138
Select 3A developer is building an application that uses an Amazon S3 bucket to store and serve static assets. The application is hosted on Amazon EC2 instances. The developer wants to ensure the EC2 instances can upload and retrieve objects from the S3 bucket. Which combination of policies should the developer use to securely grant the EC2 instances access to the S3 bucket?
- A
Attach an IAM role to the EC2 instances with a policy granting S3 access.
- B
Add a bucket policy to the S3 bucket that explicitly allows access from the EC2 IAM role.
- C
Attach an inline policy to the EC2 instances with permissions for the S3 bucket.
- D
Use an S3 ACL to grant public read and write access to the S3 bucket.
- E
Attach a managed policy to the EC2 IAM role that grants permissions for the S3 bucket.
Show answer and explanation
Correct answers: A, B, E
Explanation
To securely grant EC2 instances access to an S3 bucket, you should use a combination of IAM roles, resource-based bucket policies, and potentially managed IAM policies. The IAM role allows the instances to assume the necessary permissions, while the bucket policy explicitly grants access to the role. Inline policies cannot be directly attached to EC2 instances, and using S3 ACLs for public access is not secure for this scenario.
- A. Correct.
Correct. Attaching an IAM role to the EC2 instances with a policy granting S3 access is a secure and recommended way to provide access. The role will allow the instances to assume permissions defined in the policy.
- B. Correct.
Correct. Adding a bucket policy to the S3 bucket allows you to specify access permissions for the EC2 IAM role, ensuring that the bucket explicitly trusts the role.
- C. Incorrect.
Incorrect. Inline policies cannot be directly attached to EC2 instances. Instead, policies must be attached to roles, which can then be assigned to the EC2 instances.
- D. Incorrect.
Incorrect. Using an S3 ACL to grant public read and write access is not secure. This would expose the bucket to unauthorized access.
- E. Correct.
Correct. A managed policy can provide predefined S3 permissions, and attaching this to the EC2 IAM role is a valid approach for granting secure access.