A developer is deploying an application on a standalone Amazon EC2 instance. The application needs to read messages from an Amazon SQS queue and write records to an Amazon DynamoDB table. To follow security best practices, the developer decides to use an IAM role. Which TWO configurations or steps are required to securely grant the EC2 instance the necessary permissions? (Select TWO.)
- Create an IAM role with a trust policy that allows the ec2.amazonaws.com service principal to assume the role.Cevap
- Associate the IAM role with an EC2 instance profile and attach the instance profile to the EC2 instance.Cevap
- CStore an IAM user's long-term Access Key ID and Secret Access Key in the application's configuration file on the instance.
- DConfigure the trust policy of the IAM role to allow the dynamodb.amazonaws.com service principal to assume the role.
- EAssign the application's permission policy directly to the ECS Task Execution Role of the instance.
Cevap
To securely grant the EC2 instance permissions, the developer must create an IAM role with a trust policy allowing the EC2 service principal to assume it, and attach this role to the EC2 instance using an EC2 instance profile.
The correct configurations are to create an IAM role with a trust policy that allows the EC2 service principal (ec2.amazonaws.com) to assume the role, and to associate this role with an EC2 instance profile which is then attached to the EC2 instance. This configuration allows the application running on the EC2 instance to securely retrieve temporary security credentials from the instance metadata without hardcoding secrets.
Adım Adım Çözüm
Anahtar Kavram
Assigning IAM permissions to EC2 instances using Instance Profiles and Trust Policies