Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A retail company has a web application hosted on an Amazon EC2 instance that needs to read and write images to an Amazon S3 bucket. According to AWS security best practices, which of the following is the most secure method to grant the EC2 instance access to the S3 bucket?

  1. Attach an IAM role with the required S3 permissions to the EC2 instance.Answer
  2. B
    Embed the AWS Account Root User access keys directly within the application code.
  3. C
    Create an IAM user, generate long-lived access keys, and store them on the EC2 instance.
  4. D
    Contact AWS Support to configure the network permissions between the EC2 instance and the S3 bucket.

Answer

Attach an IAM role with the required S3 permissions to the EC2 instance.
Attaching an IAM role to the EC2 instance is the recommended best practice. AWS automatically provides temporary, short-lived security credentials to the EC2 instance through the Instance Metadata Service (IMDS). This eliminates the need to hardcode or store permanent AWS access keys on the instance, reducing the risk of credential exposure.

Step-by-Step Solution

1
Identify the AWS resource (EC2 instance) that requires permission to access another service (S3).
An application on EC2 needs to communicate with S3.
AWS services requiring access to other AWS services should use temporary credentials instead of long-lived access keys.
2
Determine the AWS-recommended mechanism for granting permissions to applications running on EC2 instances.
IAM roles are designed to grant applications on EC2 temporary access to other AWS resources.
This removes the need to store and manage static AWS credentials on the server, enhancing overall security.

Key Concept

Using IAM Roles for AWS Services
Estimated Time:45s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic