SCS-C02 Question 373
Single answerAn application running on Amazon EC2 instances needs to access objects stored in an S3 bucket. The EC2 instances are launched in an Auto Scaling group. As a security best practice, how should you configure access to the S3 bucket, ensuring minimal permissions and scalability?
- A
Attach an IAM policy with S3 permissions directly to the EC2 instances.
- B
Create an IAM role with S3 permissions, associate the role with the EC2 instances, and attach a policy allowing access to the specific S3 bucket.
- C
Use the root user credentials to access the S3 bucket from the application.
- D
Manually create individual IAM users for each EC2 instance and assign S3 bucket access to each user.
Show answer and explanation
Correct answer: B
Explanation
The best practice for granting AWS resource access to applications running on EC2 instances is to use IAM roles. IAM roles allow EC2 instances to retrieve temporary credentials for secure access to AWS resources like S3. In this scenario, associating an IAM role with the EC2 instances and attaching a policy that limits access to the specific S3 bucket ensures both scalability and adherence to the principle of least privilege.
- A. Incorrect.
Attaching an IAM policy directly to EC2 instances is not a best practice. AWS recommends using IAM roles to grant permissions to instances, as policies attached directly to instances cannot leverage temporary credentials and are less secure.
- B. Correct.
This is the correct approach. Associating an IAM role with EC2 instances allows the application to securely access S3 using temporary credentials provided by the role. Attaching a policy limiting access to the specific S3 bucket ensures the principle of least privilege.
- C. Incorrect.
Using the root user credentials is highly discouraged. The root user has unrestricted access, and exposing such credentials poses a significant security risk.
- D. Incorrect.
Creating individual IAM users for each EC2 instance is not scalable and violates best practices. IAM roles are designed for this purpose and provide temporary credentials for secure access.