A developer is deploying an application on an Amazon EC2 instance that needs to read data from an Amazon DynamoDB table and write reports to an Amazon S3 bucket. To follow security best practices, the developer decides to use an IAM role. Which two configurations are required to establish this access? (Select two.)
- Create an IAM role with an identity-based permissions policy that grants DynamoDB read access and S3 write access.Answer
- Configure the IAM role's trust policy to allow the Amazon EC2 service to assume the role.Answer
- CHardcode IAM user credentials with the required DynamoDB and S3 permissions directly into the application's configuration files.
- DDefine the DynamoDB read and S3 write permissions directly inside the IAM role's trust policy document.
- EConfigure the S3 bucket policy and DynamoDB access control settings to trust the EC2 instance's public IP address.
Answer
An IAM role must be configured with an identity-based permissions policy that grants DynamoDB read access and S3 write access, and its trust policy must allow the Amazon EC2 service to assume the role.
To grant an EC2 instance access to other AWS services securely, two components are required. First, the trust policy of the IAM role must permit the EC2 service principal to assume the role. Second, the role's permissions policy must define the specific resource-level permissions (DynamoDB read and S3 write) that the application needs to run.
Step-by-Step Solution
Key Concept
An IAM role requires both a trust policy (specifying who can assume the role) and a permissions policy (specifying what resources and actions the role can access).