SCS-C02 Question 244
Single answerYour organization has an Amazon EC2 instance running an application that needs access to objects stored in an Amazon S3 bucket. To follow security best practices, you want to avoid embedding access keys in the application code or the instance. Which solution ensures secure and least-privilege access to the S3 bucket?
- A
Create an IAM user with programmatic access keys and configure the application to use those keys.
- B
Assign an IAM instance role to the EC2 instance with a policy granting access to the S3 bucket.
- C
Create an IAM service role for S3 and attach it to the S3 bucket.
- D
Use AWS Secrets Manager to store S3 access keys and retrieve them from the application at runtime.
Show answer and explanation
Correct answer: B
Explanation
The best way to provide secure and least-privilege access to an S3 bucket from an EC2 instance is by assigning an IAM instance role to the instance. The role allows the instance to obtain temporary credentials via the instance metadata service, eliminating the need to hardcode or manage long-term access keys. This approach aligns with AWS security best practices and reduces the risk of credential exposure.
- A. Incorrect.
Embedding access keys directly in the application or on the instance is not a security best practice as it can lead to key exposure and compromise.
- B. Correct.
Assigning an IAM instance role to the EC2 instance is the correct solution. This allows the instance to securely retrieve temporary credentials from the instance metadata service, granting least-privilege access without hardcoding credentials.
- C. Incorrect.
IAM service roles are used for AWS services to perform actions on your behalf. They are not intended for use with EC2 instances accessing resources like S3.
- D. Incorrect.
While AWS Secrets Manager is useful for managing secrets, storing S3 access keys in Secrets Manager does not address the security concern of avoiding long-term credentials. Using IAM roles is a more secure and scalable solution.