Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

An administrator needs to configure an application running on an Amazon EC2 instance to read files from an Amazon S3 bucket. According to AWS security best practices, which approach should the administrator use to grant the EC2 instance the necessary permissions?

  1. A
    Create an IAM user with S3 read permissions, generate access keys, and embed them in the application code running on the EC2 instance.
  2. B
    Generate access keys for the AWS account root user and store them in a configuration file on the EC2 instance.
  3. Create an IAM role with S3 read permissions and associate it with the EC2 instance.Answer
  4. D
    Submit a request to AWS Support to manage and configure the permissions for the EC2 instance's access to the S3 bucket.

Answer

Create an IAM role with S3 read permissions and associate it with the EC2 instance.
Associating an IAM role with the EC2 instance is the recommended practice because it delegates temporary credentials to the instance. This prevents the need to manage, store, or rotate static access keys on the instance itself.

Step-by-Step Solution

1
Determine if the accessing entity is an AWS resource or a human user.
The accessing entity is an Amazon EC2 instance (an AWS service resource).
AWS services should authenticate using temporary credentials rather than permanent, hardcoded credentials.
2
Identify the AWS security best practice for resource-to-resource authentication.
Create an IAM role with the minimum required S3 read permissions and attach it to the EC2 instance.
IAM roles leverage AWS Security Token Service (STS) to deliver temporary, automatically rotating credentials to the EC2 instance.

Key Concept

IAM Roles for AWS Services
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic