DVA-C02 Question 160
Single answerA development team is building an application that needs to upload and retrieve objects from an Amazon S3 bucket. The application will run on multiple Amazon EC2 instances. To ensure secure and seamless access to the S3 bucket, what is the MOST appropriate way to grant the EC2 instances the required permissions?
- A
Create an IAM user with S3 permissions, generate access keys, and store them on each EC2 instance.
- B
Attach an IAM role to the EC2 instances with a policy that grants the required S3 permissions.
- C
Add the EC2 instance IDs to the S3 bucket policy to grant them access.
- D
Manually configure S3 access permissions in the instance metadata.
Show answer and explanation
Correct answer: B
Explanation
The best practice for granting EC2 instances access to AWS resources like S3 is to use IAM roles. When an IAM role is attached to an EC2 instance, the instance automatically receives temporary credentials via the instance metadata. This approach eliminates the need to manage long-term credentials and ensures secure access to AWS resources.
- A. Incorrect.
Creating an IAM user and using access keys on the EC2 instances is not a best practice because it involves managing credentials manually, which increases security risks.
- B. Correct.
Attaching an IAM role to the EC2 instances is the correct and recommended approach. IAM roles allow secure, temporary access to AWS resources without the need to manage long-term credentials.
- C. Incorrect.
S3 bucket policies cannot directly reference EC2 instance IDs. You can use bucket policies to restrict or allow access based on IAM roles or user permissions, but not based on EC2 instance IDs.
- D. Incorrect.
Instance metadata does not allow you to configure IAM permissions. It is used to retrieve temporary credentials from an attached IAM role, but you cannot set permissions directly in the metadata.