SCS-C02 Question 318
Select 3A company has an application running on an Amazon EC2 instance that needs access to an Amazon S3 bucket. The developers report that the application is unable to access the bucket. The EC2 instance has an IAM role attached granting the required permissions. How can you troubleshoot and resolve the issue using AWS tools?
- A
Use AWS CloudTrail to verify if the application is making requests to the S3 bucket and check for any denied API calls.
- B
Use the IAM Access Advisor to confirm whether the permissions attached to the IAM role have been recently used by the EC2 instance.
- C
Use the IAM Policy Simulator to simulate the IAM role's permissions and verify if the S3 bucket access permissions are correctly configured.
- D
Check the EC2 instance's security group to ensure that it allows outbound traffic to the S3 service endpoint.
- E
Verify the S3 bucket policy to ensure that it explicitly allows access from the IAM role's Principal.
Show answer and explanation
Correct answers: A, C, D
Explanation
To troubleshoot authorization issues, it's essential to use tools like CloudTrail to check for denied API calls, the IAM Policy Simulator to test the IAM role's permissions, and ensure that the EC2 instance can communicate with the S3 service through its security group. While verifying the S3 bucket policy can help in some cases, the problem described here is specifically related to the IAM role's permissions and network connectivity, making the other tools more suitable for resolving the issue.
- A. Correct.
CloudTrail helps identify whether the application is making API requests and if those requests are being denied. This is a crucial step in troubleshooting authorization issues.
- B. Incorrect.
IAM Access Advisor is used to view recently accessed AWS services but does not provide detailed troubleshooting for specific API calls or permissions issues.
- C. Correct.
The IAM Policy Simulator can be used to test the permissions granted by the IAM role and verify access to the S3 bucket, making it a useful tool for troubleshooting.
- D. Correct.
The EC2 instance's security group must allow outbound traffic to the S3 service endpoint. If outbound traffic is restricted, the application cannot reach S3, even with proper IAM permissions.
- E. Incorrect.
The S3 bucket policy is important, but in this case, the issue described is related to the IAM role attached to the EC2 instance. While checking the bucket policy is good practice, it is not the primary focus for troubleshooting the IAM role's permissions.