A developer is configuring an application running on an Amazon EC2 instance that needs to read items from an Amazon DynamoDB table. The developer has created the following trust policy for an IAM role:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Which TWO steps must the developer complete to enable the application on the EC2 instance to securely access the DynamoDB table without hardcoding credentials?
- Attach a permissions policy to the IAM role that grants the necessary DynamoDB permissions (such as dynamodb:GetItem).Cevap
- Associate the IAM role with an IAM instance profile and attach the instance profile to the EC2 instance.Cevap
- CEmbed IAM user access keys with DynamoDB permissions directly in the application's configuration files.
- DChange the service principal in the trust policy to dynamodb.amazonaws.com so the database can access the instance.
- EAttach the IAM permissions policy directly to the EC2 instance's security group using the AWS Management Console.
Cevap
To securely grant access, the developer must attach a permissions policy with DynamoDB access to the IAM role, and then associate the IAM role with an IAM instance profile and attach it to the EC2 instance.
The correct steps are to attach a permissions policy containing the required DynamoDB permissions to the IAM role, and to associate the role with an IAM instance profile and attach it to the EC2 instance. This combination allows the application on the EC2 instance to assume the role and gain the necessary permissions to read DynamoDB data securely.
Adım Adım Çözüm
Anahtar Kavram
Granting EC2 instances permissions to access AWS services using IAM roles and instance profiles.
Tahmini Süre:1m 30s