SCS-C02 Question 245
Single answerAn organization has deployed an EC2 instance that needs to access an S3 bucket to store logs. The security team wants to ensure that the instance can access the bucket securely without hardcoding any AWS credentials into the application running on the instance. Which is the MOST appropriate solution to meet this requirement?
- A
Assign an IAM instance role to the EC2 instance with the necessary permissions to access the S3 bucket.
- B
Manually configure the AWS credentials on the EC2 instance by creating an AWS access key and secret key.
- C
Create a user-specific IAM policy and attach it to the EC2 instance.
- D
Use an IAM service role and assign it to the S3 bucket.
Show answer and explanation
Correct answer: A
Explanation
IAM instance roles are the most appropriate solution when an application running on an EC2 instance needs access to AWS resources like S3. They provide temporary credentials through the instance metadata service, ensuring secure and automated credential management without requiring manual configuration or exposing sensitive credentials.
- A. Correct.
This is the correct answer. IAM instance roles allow EC2 instances to securely access AWS resources without the need to hardcode credentials. The role provides temporary credentials that are automatically rotated.
- B. Incorrect.
This is incorrect. Hardcoding AWS credentials is a security risk and not recommended as it exposes your access keys, making them vulnerable to compromise.
- C. Incorrect.
This is incorrect. IAM policies cannot be directly attached to EC2 instances. Instead, roles are used to provide permissions to instances.
- D. Incorrect.
This is incorrect. IAM service roles are typically used for AWS services to perform actions on behalf of the user, not for directly providing permissions to EC2 instances.