SAP-C02 Question 419
Single answerA company is deploying an application in AWS that requires access to an Amazon S3 bucket to store logs. The application runs on Amazon EC2 instances within an Auto Scaling group. To comply with the principle of least privilege access, how should you configure access for the application to the S3 bucket?
- A
Assign an IAM role to the EC2 instances with a policy granting only the required S3 permissions.
- B
Embed an access key and secret key with full S3 permissions in the application code.
- C
Attach an IAM policy with full S3 permissions directly to the Auto Scaling group.
- D
Assign an IAM role to the EC2 instances with a policy granting full S3 permissions.
Show answer and explanation
Correct answer: A
Explanation
The principle of least privilege dictates that entities should be granted only the permissions they need to perform their tasks, nothing more. Assigning an IAM role to the EC2 instances with a policy granting only the required S3 permissions adheres to this principle. It ensures secure access to the S3 bucket while minimizing the risk of over-permissioning.
- A. Correct.
This is the correct approach as it uses an IAM role for the EC2 instances, applying the principle of least privilege by granting only the necessary permissions to access the specific S3 bucket.
- B. Incorrect.
Embedding access keys and secret keys in the application code violates security best practices and does not align with the principle of least privilege since it could lead to over-permissioning and potential exposure.
- C. Incorrect.
IAM policies cannot be directly attached to an Auto Scaling group. Additionally, granting full S3 permissions violates the principle of least privilege.
- D. Incorrect.
Granting full S3 permissions violates the principle of least privilege, as the application should be granted only the permissions needed to access the specific S3 bucket.