DVA-C02 Question 157
Single answerYou are developing an application that runs on Amazon EC2 instances and uses Amazon S3 for storing user-uploaded images. Your team has decided to use an IAM role to allow the application to securely upload images to an S3 bucket. However, after deploying the application, you notice that the images are not being uploaded to the S3 bucket. What is the MOST likely reason for this issue?
- A
The IAM role attached to the EC2 instance does not have a policy granting permissions to upload objects to the S3 bucket.
- B
The IAM role attached to the EC2 instance is not being assumed by the application.
- C
The bucket policy for the S3 bucket explicitly denies access from the EC2 instance.
- D
The EC2 instance does not have the correct user data script to configure the IAM role.
Show answer and explanation
Correct answer: A
Explanation
The most likely reason for the issue is that the IAM role attached to the EC2 instance does not have the necessary permissions to upload objects to the S3 bucket. IAM roles allow services like EC2 to interact with others like S3 securely. To enable this, you must attach an appropriate policy to the role granting permissions for the required actions, such as 's3:PutObject' for uploading files. In this scenario, the absence of such permissions would lead to the described problem.
- A. Correct.
This is the correct answer. If the IAM role does not have a policy that grants permissions to upload objects to the S3 bucket, the application running on the EC2 instance will not be able to perform the upload operation.
- B. Incorrect.
While roles need to be assumed in some contexts, in the case of an EC2 instance, the attached IAM role is automatically assumed by the instance metadata service. This is not the correct answer.
- C. Incorrect.
A bucket policy could deny access, but this scenario focuses on an issue with the IAM role, making this an incorrect answer.
- D. Incorrect.
User data scripts are used for initializing EC2 instances, not for assigning IAM roles. This is not relevant to the described problem.