SCS-C02 Question 374
Select 2An organization is using an EC2 instance to run a critical application. They want the instance to securely access an S3 bucket in the same account without requiring long-term access keys. Which of the following steps should you take to achieve this?
- A
Create an IAM role with the required S3 permissions and attach it to the EC2 instance.
- B
Create an IAM user with the required S3 permissions, generate access keys, and store them on the EC2 instance.
- C
Create a policy granting access to the S3 bucket and attach it directly to the EC2 instance.
- D
Ensure the S3 bucket policy allows access from the IAM role attached to the EC2 instance.
- E
Attach the AmazonS3FullAccess managed policy directly to the EC2 instance.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure secure access from an EC2 instance to an S3 bucket, you should use an IAM role. The role should have a policy granting the required S3 permissions, and it must be attached to the EC2 instance. Additionally, the S3 bucket policy must explicitly allow access from the IAM role attached to the instance. This approach eliminates the need for long-term credentials and follows AWS best practices for security.
- A. Correct.
Correct. Attaching an IAM role with the required S3 permissions to the EC2 instance allows it to securely access the S3 bucket without using long-term credentials.
- B. Incorrect.
Incorrect. IAM users and access keys are not recommended for applications running on EC2 instances because they involve managing long-term credentials, which is less secure.
- C. Incorrect.
Incorrect. IAM policies cannot be directly attached to EC2 instances. Instead, they must be associated with an IAM role that is attached to the instance.
- D. Correct.
Correct. The S3 bucket policy must allow access from the IAM role attached to the EC2 instance to ensure the instance can access the bucket.
- E. Incorrect.
Incorrect. Managed policies like AmazonS3FullAccess cannot be directly attached to EC2 instances. They must be attached to an IAM role, which is then associated with the instance.