SCS-C02 Question 372
Single answerAn organization uses an IAM role to allow its EC2 instances to access an S3 bucket. Recently, some EC2 instances have been unable to access the S3 bucket, while others can access it without issue. Upon investigation, you find that the IAM role attached to the instances appears to be configured correctly, and the S3 bucket policy allows access from the role. What could be the most likely reason for the issue?
- A
The EC2 instances do not have the correct instance profile attached.
- B
The S3 bucket is encrypted with a KMS key, and the IAM role lacks permissions to use the key.
- C
The IAM role has reached its maximum session duration.
- D
The EC2 instances are in a private subnet without a route to the S3 bucket.
Show answer and explanation
Correct answer: A
Explanation
The issue is most likely related to the EC2 instance profile, which is required for the instance to assume an IAM role. If the instance profile is not attached or is misconfigured, the instance will not have the temporary credentials needed to access the S3 bucket, even if the IAM role and bucket policy are correctly configured. This ensures the role-based access mechanism is functional.
- A. Correct.
Correct. For an EC2 instance to use an IAM role, the role must be associated with an instance profile and attached to the instance. If the instance profile is missing or incorrectly configured, the EC2 instance will not assume the role and cannot access S3.
- B. Incorrect.
Incorrect. While KMS permissions could cause access issues to an encrypted bucket, this is not the most likely issue given that other EC2 instances can access the bucket. This would typically result in a specific AccessDenied error for encryption, which is not mentioned in the scenario.
- C. Incorrect.
Incorrect. The default session duration for IAM roles is sufficient for most use cases, and a role's session expiration would not selectively affect only certain EC2 instances.
- D. Incorrect.
Incorrect. Route issues would affect all EC2 instances in a particular network setup, and the scenario indicates that some instances can access the S3 bucket, ruling this out.