Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

An application running on an Amazon EC2 instance needs to securely access files in an Amazon S3 bucket. According to AWS security best practices, which IAM entity should be attached to the EC2 instance to grant these permissions without storing long-term credentials?

  1. A
    An IAM group
  2. An IAM roleAnswer
  3. C
    An IAM user
  4. D
    The AWS account root user

Answer

An IAM role
The correct answer is an IAM role because IAM roles are designed to delegate permissions to AWS services, applications, or users without requiring long-term security credentials. By attaching an IAM role (specifically via an instance profile) to an Amazon EC2 instance, AWS automatically manages and rotates temporary credentials for the application to access Amazon S3.

Step-by-Step Solution

1
Identify the authentication requirement.
An application on an EC2 instance needs to access an S3 bucket without storing long-term credentials.
Storing long-term credentials on instances exposes them to potential leakage.
2
Determine the appropriate IAM entity for service-to-service authentication.
An IAM role provides temporary security credentials that can be automatically rotated.
AWS services use IAM roles to safely access other AWS resources under the principle of least privilege.

Key Concept

IAM Roles for AWS Services
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic