SCS-C02 Question 293
Single answerAn organization leverages Amazon EC2 instances to run critical workloads. To access an S3 bucket, the organization wants to avoid hardcoding long-term credentials in the application code or the EC2 instances. What is the best way to securely provide temporary credentials to the EC2 instances for accessing the S3 bucket?
- A
Use an IAM role assigned to the EC2 instance with the required S3 permissions.
- B
Manually create IAM access keys and store them securely on the EC2 instance.
- C
Use AWS Secrets Manager to store long-term credentials and retrieve them when needed.
- D
Configure the EC2 instance with an IAM user that has the required S3 permissions.
Show answer and explanation
Correct answer: A
Explanation
The best practice for securely providing temporary credentials to EC2 instances is to assign an IAM role to the instance. This allows the instance to assume the role via the instance metadata service and obtain temporary credentials for accessing AWS services such as S3. This approach avoids the risks associated with long-term credentials and aligns with AWS security best practices.
- A. Correct.
This is the correct answer. Assigning an IAM role to the EC2 instance allows it to securely assume the role and obtain temporary credentials via the instance metadata service, avoiding the need for hardcoding or manual credential management.
- B. Incorrect.
Manually creating and storing IAM access keys on the EC2 instance is not secure or recommended. This approach risks exposing long-term credentials and violates AWS security best practices.
- C. Incorrect.
While AWS Secrets Manager is a secure way to store and manage secrets, it does not eliminate the use of long-term credentials in this scenario. The IAM role approach is more secure and streamlined for EC2 instances.
- D. Incorrect.
IAM users are intended for human users or applications outside of AWS. Configuring an EC2 instance with an IAM user requires long-term credentials and is not recommended for this use case.