Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is deploying a web application on an Amazon EC2 instance that needs to read and write files to an Amazon S3 bucket. Which of the following is the AWS-recommended best practice to grant the application access to the S3 bucket?

  1. A
    Create an IAM user with S3 permissions, generate access keys, and store them directly in the application configuration files on the EC2 instance.
  2. B
    Use the AWS account root user credentials inside the application configuration to guarantee access to the S3 bucket.
  3. Create an IAM role with the necessary S3 permissions and attach it to the Amazon EC2 instance.Answer
  4. D
    Rely on the AWS shared responsibility model, which automatically grants access permissions between compute and storage services within the same account.

Answer

Create an IAM role with the necessary S3 permissions and attach it to the Amazon EC2 instance.
Creating an IAM role and attaching it to the Amazon EC2 instance is the recommended practice. AWS handles the rotation of temporary security credentials automatically, preventing the security risks associated with managing and storing long-term credentials on the instance.

Step-by-Step Solution

1
Determine if the requester is an AWS service or a human user.
The requester is an Amazon EC2 instance running a web application.
AWS services should use roles with temporary credentials rather than users with permanent access keys to access other AWS services.
2
Identify the permissions needed and apply the principle of least privilege.
Create a policy that permits only read and write actions on the specific S3 bucket.
Ensuring least privilege minimizes the potential impact of a security compromise.
3
Associate the permissions with the EC2 instance using a role.
Attach the policy to an IAM role, and then associate that role with the EC2 instance.
The application on the EC2 instance can then retrieve temporary security credentials automatically from instance metadata.

Key Concept

Granting temporary credentials to AWS resources using IAM roles is a fundamental security best practice.
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic