SCS-C02 Question 247
Single answerAn application running on an Amazon EC2 instance requires access to an Amazon S3 bucket to retrieve configuration files and write logs. The application also interacts with Amazon DynamoDB to query data. What is the most secure and scalable way to grant the required permissions to the EC2 instance?
- A
Attach an IAM policy directly to the EC2 instance.
- B
Create an IAM user with the necessary permissions and store the access key and secret key on the instance.
- C
Create an IAM instance role with the necessary permissions and associate it with the EC2 instance.
- D
Manually generate temporary credentials using AWS STS and store them on the instance.
Show answer and explanation
Correct answer: C
Explanation
The most secure and scalable way to grant permissions to an EC2 instance is by using an IAM instance role. When the instance is launched with an associated IAM instance role, it automatically retrieves temporary credentials from the instance metadata service, allowing it to access AWS resources as specified by the role's policies. This eliminates the need for manual credential management and reduces the risk of credential exposure.
- A. Incorrect.
IAM policies cannot be directly attached to EC2 instances. Permissions are assigned to roles, which are then associated with the instance.
- B. Incorrect.
Storing access and secret keys on the instance introduces a security risk as these credentials could be exposed or compromised.
- C. Correct.
IAM instance roles allow the EC2 instance to automatically assume a role and use temporary credentials to access AWS resources securely without embedding credentials in the instance.
- D. Incorrect.
Manually generating temporary credentials is a cumbersome and error-prone process that does not scale well and is not recommended when IAM instance roles are available.