Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

An enterprise is deploying an application on Amazon EC2 instances that needs to retrieve files from an Amazon S3 bucket. Which of the following configurations represent AWS Identity and Access Management (IAM) best practices for this scenario? (Select TWO.)

  1. A
    Embed the AWS account root user's access keys in the application configuration to ensure uninterrupted access.
  2. Attach an IAM role with the necessary S3 access permissions directly to the Amazon EC2 instances.Answer
  3. C
    Store the long-term access keys of an IAM user directly within the application code.
  4. Configure a least-privilege IAM policy and attach it to the IAM role.Answer
  5. E
    Contact AWS Support to configure the virtualization layer of the EC2 instances to allow S3 access.

Answer

Attach an IAM role with the necessary S3 access permissions directly to the Amazon EC2 instances, and configure a least-privilege IAM policy and attach it to the IAM role.
The correct configuration is to associate an IAM role with the Amazon EC2 instance and attach a least-privilege policy to that role. This follows AWS best practices by granting only the necessary permissions and using temporary credentials for programmatic access.

Step-by-Step Solution

1
Determine the authentication mechanism for applications running on AWS compute resources.
Identified that IAM roles should be used to assign permissions to AWS resources like EC2 instances.
This eliminates the need to manage and secure long-term credentials in code.
2
Define the specific resource access requirements.
The application only needs to read files from a specific Amazon S3 bucket.
Enables the design of a highly restrictive permission policy.
3
Apply the IAM policy to the role using the principle of least privilege.
Created a customer-managed policy with read-only access to the S3 bucket and attached it to the EC2 role.
Ensures that the application has only the access necessary to perform its job.

Key Concept

AWS Identity and Access Management (IAM) roles and policy configurations for applications on Amazon EC2 instances
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic