SAA-C03 Question 43
Single answerAn application running on Amazon EC2 instances needs to access an Amazon S3 bucket to store logs. The application currently stores the AWS access key and secret key in a configuration file on the instance. What is the most secure and recommended way to provide the necessary permissions to the application?
- A
Use an IAM role assigned to the EC2 instance to grant the necessary permissions.
- B
Store the AWS access key and secret key in an encrypted file on the instance.
- C
Hardcode the AWS access key and secret key into the application code.
- D
Use Amazon S3 bucket policies to directly allow access to the application.
Show answer and explanation
Correct answer: A
Explanation
The recommended approach for securely granting permissions to applications running on EC2 instances is to use IAM roles. By assigning an IAM role to the instance, you eliminate the need to store and manage credentials manually. The instance can retrieve temporary credentials from the instance metadata service, which are automatically rotated and managed by AWS.
- A. Correct.
Correct. Assigning an IAM role to the EC2 instance allows the application to securely access AWS resources without the need to manage credentials manually. The IAM role provides temporary credentials via the instance metadata service.
- B. Incorrect.
Incorrect. While encrypting the credentials provides an additional layer of security, it still requires manual management of keys and is not considered a best practice in AWS for applications running on EC2.
- C. Incorrect.
Incorrect. Hardcoding credentials into the application code is highly insecure and violates AWS security best practices. If the code is exposed, the credentials can be compromised.
- D. Incorrect.
Incorrect. Amazon S3 bucket policies can control access to S3 resources but do not directly provide a secure way for applications running on EC2 instances to authenticate themselves.