A developer is deploying an application on an Amazon EC2 instance. The application is designed to read messages from an Amazon SQS queue named `orders-queue` and write the processed items to an Amazon DynamoDB table named `orders-table`. The developer wants to configure the necessary permissions by following security best practices and avoiding hardcoded credentials. Which two configurations are required to meet these requirements? (Select TWO.)
- Create an IAM role with a permissions policy that allows the `sqs:ReceiveMessage` and `sqs:DeleteMessage` actions on the queue ARN, and the `dynamodb:PutItem` action on the table ARN.Cevap
- Associate the IAM role with an IAM instance profile, and attach the instance profile to the EC2 instance.Cevap
- CConfigure the IAM role's trust policy to trust `sqs.amazonaws.com` and `dynamodb.amazonaws.com` as the principal services.
- DStore AWS Access Key ID and Secret Access Key in a local application configuration file on the EC2 instance to initialize the SDK client.
- EAdd a statement to the IAM role's trust policy that allows the IAM instance profile ARN to assume the role.
Cevap
Create an IAM role with a permissions policy that allows SQS and DynamoDB actions, and associate the IAM role with an IAM instance profile attached to the EC2 instance.
To grant the EC2 instance access to SQS and DynamoDB without hardcoding credentials, the developer must create an IAM role with a permissions policy allowing SQS and DynamoDB actions, and associate the role with an IAM instance profile attached to the EC2 instance. This allows the application to retrieve temporary credentials automatically via the instance metadata service.
Adım Adım Çözüm
Anahtar Kavram
To securely grant applications running on EC2 instances access to AWS resources, create an IAM role with the required permissions, configure its trust policy to trust the EC2 service, and associate the role with the instance using an IAM instance profile.