SCS-C02 Question 246
Single answerYou are building a web application hosted on an Amazon EC2 instance that needs to upload files to an S3 bucket. To follow AWS security best practices, how should you grant the EC2 instance access to the S3 bucket?
- A
Embed an access key and secret key for an IAM user in the application code.
- B
Create an IAM instance role with the necessary permissions and attach it to the EC2 instance.
- C
Manually configure the S3 bucket’s ACL to allow access from the EC2 instance.
- D
Use a pre-signed URL generated in advance to allow the EC2 instance to access the S3 bucket.
Show answer and explanation
Correct answer: B
Explanation
To securely grant an Amazon EC2 instance access to an S3 bucket, you should use an IAM instance role. This allows the EC2 instance to assume the role and obtain temporary, automatically rotated credentials to access the S3 bucket. This approach adheres to AWS security best practices, avoids hardcoding credentials, and ensures secure, least-privileged access.
- A. Incorrect.
Embedding access keys in application code is a security anti-pattern and increases the risk of credential leakage if the code is exposed.
- B. Correct.
Creating an IAM instance role with the necessary permissions and attaching it to the EC2 instance is the correct approach. This follows the principle of least privilege and avoids hardcoding credentials.
- C. Incorrect.
Manually configuring the S3 bucket’s ACL is not the recommended way to grant access. While it can work, it does not leverage IAM best practices and can lead to overly permissive access.
- D. Incorrect.
Using a pre-signed URL is not a scalable or secure solution for continuous access. It is better suited for temporary and limited access scenarios.