SAA-C03 Question 7
Single answerA company is building a web application hosted on Amazon EC2 instances in a private subnet. The application needs to securely access data stored in an Amazon S3 bucket. The company requires that no S3 bucket credentials are hardcoded in the application, and all communication must remain private. How should the company securely configure access to the S3 bucket?
- A
Assign an IAM role to the EC2 instances and configure a VPC endpoint for S3.
- B
Store the S3 bucket credentials in an encrypted file on the EC2 instances.
- C
Use an IAM user with programmatic access keys and configure the application to use these keys.
- D
Configure a public-facing NAT Gateway in the VPC and use it for accessing the S3 bucket.
Show answer and explanation
Correct answer: A
Explanation
The correct approach to securely access an S3 bucket from EC2 instances in a private subnet is to assign an IAM role to the EC2 instances, which provides temporary credentials without hardcoding them. Configuring a VPC endpoint for S3 ensures that all traffic between the EC2 instances and the S3 bucket remains private within the AWS network, eliminating the need to route traffic through the internet or use a NAT Gateway.
- A. Correct.
This is the correct solution. Assigning an IAM role to the EC2 instances allows temporary credentials to be securely managed without hardcoding them. Configuring a VPC endpoint for S3 ensures that all traffic between the EC2 instances and the S3 bucket remains private within the AWS network.
- B. Incorrect.
This is not a secure solution because storing credentials in an encrypted file increases the risk of accidental exposure or misuse, and it does not meet the requirement of avoiding hardcoded credentials.
- C. Incorrect.
Using an IAM user with programmatic access keys involves hardcoding credentials, which is not secure and violates the requirement to avoid hardcoded S3 bucket credentials.
- D. Incorrect.
A NAT Gateway is not required to access an S3 bucket if a VPC endpoint for S3 is configured. Additionally, a public-facing NAT Gateway would route traffic through the internet, which does not meet the requirement to keep communication private.