A developer is writing a Node.js application that will run on an Amazon EC2 instance. The application needs to retrieve objects from an Amazon S3 bucket using the AWS SDK. To follow security best practices, the developer wants to avoid managing long-term AWS credentials on the instance.
Which configuration should the developer use to allow the AWS SDK to access the S3 bucket securely?
- Attach an IAM role with S3 read permissions to the EC2 instance, and initialize the AWS SDK client without passing any credentials.Answer
- BHardcode an IAM User's access key ID and secret access key directly in the AWS SDK client constructor within the application source code.
- CStore the IAM User's access key ID and secret access key in Systems Manager Parameter Store as plaintext, and retrieve them during client initialization.
- DCreate an IAM role for the EC2 instance, but define the Amazon S3 permission statements directly within the role's trust policy.
Answer
Attach an IAM role with S3 read permissions to the EC2 instance, and initialize the AWS SDK client without passing any credentials.
Attaching an IAM role to the EC2 instance allows the AWS SDK to retrieve temporary security credentials from the EC2 Instance Metadata Service (IMDS). Because the default credential provider chain automatically queries IMDS when no other credentials are found, initializing the client without arguments is the most secure and native approach.
Step-by-Step Solution
Key Concept
AWS SDK Default Credential Provider Chain and IAM Roles for EC2
Estimated Time:1m 0s