Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An organization wants to configure an application running on an Amazon EC2 instance to read files from an Amazon S3 bucket. The application must not store long-term AWS credentials on the instance. Which of the following solutions represents the AWS-recommended best practice to grant the necessary permissions?

  1. Create an IAM role with S3 read permissions and associate it with the EC2 instance using an instance profile.Answer
  2. B
    Create a dedicated IAM user, generate long-term access keys with S3 read permissions, and store them in the application's configuration file on the EC2 instance.
  3. C
    Enable programmatic access for the AWS account root user and configure the application to use the root access keys for administrative simplicity.
  4. D
    Rely on the AWS shared responsibility model to automatically grant any EC2 instance within the VPC access to S3 buckets in the same region without manual configuration.

Answer

Create an IAM role with S3 read permissions and associate it with the EC2 instance using an instance profile.
The correct option is to create an IAM role with S3 read permissions and associate it with the EC2 instance. This method uses temporary security credentials that are automatically distributed and rotated by AWS, fulfilling the security requirement of not storing long-term credentials on the instance.

Step-by-Step Solution

1
Define permissions using an IAM policy that allows read-only access to the target Amazon S3 bucket.
An IAM policy document specifying the allowed S3 actions is created.
This establishes the minimum required permissions following the principle of least privilege.
2
Create an IAM role and attach the read-only S3 policy to it.
An IAM role is created with the necessary permissions associated.
An IAM role allows AWS services to assume permissions dynamically without long-term credentials.
3
Associate the IAM role with the EC2 instance via an instance profile.
The EC2 instance is now authorized to retrieve temporary credentials from the instance metadata service.
This enables the application to authenticate securely and automatically rotate credentials without hardcoding them.

Key Concept

AWS IAM Roles for EC2 Instances
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic