SAA-C03 Question 44
Single answerYou are developing an application that will run on Amazon EC2 instances. The application requires access to an Amazon S3 bucket to store and retrieve files. How can you securely provide the application with the necessary credentials to access the S3 bucket?
- A
Embed the AWS access key and secret key directly in the application code.
- B
Use an IAM role assigned to the EC2 instance to grant access to the S3 bucket.
- C
Store the AWS access key and secret key in the EC2 instance's user data script.
- D
Manually create long-term access keys and distribute them to the EC2 instance.
Show answer and explanation
Correct answer: B
Explanation
Assigning an IAM role to an EC2 instance is the best practice for securely providing applications running on the instance with access to AWS resources. The role allows the instance to request temporary credentials from the instance metadata service, eliminating the need to hardcode or manually manage credentials. This approach minimizes security risks and follows AWS's recommended guidelines for application configuration and credentials management.
- A. Incorrect.
Embedding AWS access keys and secret keys directly in the application code is highly insecure. If the code is exposed (e.g., through version control or shared repositories), the credentials can be compromised.
- B. Correct.
Using an IAM role assigned to the EC2 instance is a secure and recommended approach. The EC2 instance can automatically retrieve temporary credentials via the instance metadata service without hardcoding credentials.
- C. Incorrect.
Storing credentials in the EC2 instance's user data script is not secure because user data is accessible to anyone with access to the EC2 instance. This method increases the risk of credential leakage.
- D. Incorrect.
Manually creating and distributing long-term access keys is insecure and not scalable. Long-term keys are more vulnerable to misuse and compromise compared to temporary credentials provided by an IAM role.