SAA-C03 Q123 · IAM

Question

A company is developing a new application that will run on Amazon EC2 instances. The application needs to access multiple AWS services. The company needs to ensure that the application will not use long-term access keys to access AWS services. What should a solutions architect do to meet these requirements?

Accepted Answer

**Option D** satisfies every requirement:

1. **No long-term access keys**: IAM roles do not use static access keys. Instead, the EC2 instance automatically receives **temporary security credentials** via the instance metadata service (IMDS). These credentials are rotated automatically by AWS (typically every ~6 hours).

2. **Access to multiple AWS services**: The IAM role's policy defines exactly which AWS services and actions the application can use. You attach the necessary permissions to this single role.

3. **How it works mechanically**:
   - You create an IAM role with the required permissions policies
   - You create an **instance profile** (a container for the role) and associate it with the EC2 instances
   - When the application runs, the AWS SDK automatically retrieves temporar

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips