SCS-C02 Question 295
Single answerAn organization is using an application running on Amazon EC2 instances that require access to an Amazon S3 bucket to store and retrieve logs. The organization wants to follow best practices for secure access and ensure credentials are rotated automatically without manual intervention. Which mechanism should be used to grant the application access to the S3 bucket?
- A
Create an IAM user with access to the S3 bucket and embed the access keys in the application code.
- B
Assign an IAM role to the EC2 instances with permissions to access the S3 bucket.
- C
Generate temporary security credentials using the AWS Security Token Service (STS) and manually update the application.
- D
Use hardcoded long-term credentials in the application's configuration file.
Show answer and explanation
Correct answer: B
Explanation
The best way to provide secure and scalable access for applications running on Amazon EC2 instances is by using IAM roles. IAM roles allow secure access to AWS resources without the need to manage or embed credentials manually. AWS automatically assigns temporary credentials to the instance profile and rotates them, ensuring better security and compliance with AWS best practices.
- A. Incorrect.
This is not a recommended approach because embedding IAM user access keys in application code is insecure and can lead to credential exposure if the code is compromised or shared.
- B. Correct.
This is the correct answer. Assigning an IAM role to the EC2 instances allows the application to securely access AWS resources, such as the S3 bucket, without requiring hardcoded credentials. The credentials are automatically rotated by AWS.
- C. Incorrect.
Manually generating and updating temporary security credentials is not practical or scalable, especially in dynamic environments. AWS provides mechanisms such as IAM roles that automate this process.
- D. Incorrect.
Hardcoding long-term credentials in configuration files is highly insecure and violates AWS security best practices, as it increases the risk of accidental exposure or misuse.