SCS-C02 Question 302
Single answerAn organization has an internal application running on an Amazon EC2 instance within a private subnet. The application needs to read data from an Amazon S3 bucket in the same AWS account. A security engineer has been tasked with designing an authorization mechanism that ensures least privilege and does not require hardcoding credentials into the application code. How should the security engineer achieve this?
- A
Attach an AmazonS3FullAccess policy to the EC2 instance's IAM role.
- B
Create an IAM role with an Amazon S3 read-only policy and attach it to the EC2 instance.
- C
Generate an IAM user with programmatic access keys and store the keys in the application code.
- D
Create a bucket policy on the S3 bucket to allow access only from the EC2 instance's private IP address.
Show answer and explanation
Correct answer: B
Explanation
The most secure and recommended way to authorize an EC2 instance to access an S3 bucket is by attaching an IAM role to the instance. The role should have a policy that grants the minimal permissions necessary, such as read-only access to the bucket. This avoids the risks of hardcoding credentials and ensures compliance with the principle of least privilege.
- A. Incorrect.
This option grants excessive permissions (full access) to the S3 bucket, violating the principle of least privilege. It is not the best practice for securing AWS resources.
- B. Correct.
This option follows the principle of least privilege by granting only the necessary permissions (read-only access) and is the recommended approach for authorizing an EC2 instance to access an S3 bucket without hardcoding credentials.
- C. Incorrect.
This option involves hardcoding credentials into the application code, which is a security risk and violates AWS best practices.
- D. Incorrect.
While restricting access by IP address can provide some security, this approach does not work for private EC2 instances because S3 bucket policies do not support direct IP-based restrictions for private IPs assigned to EC2 instances.