SAA-C03 Q348 · IAM

Question

A company runs an application on EC2 instances that need access to RDS credentials stored in AWS Secrets Manager. Which solution meets this requirement?

Accepted Answer

**Answer A is correct because it follows AWS best practices for granting EC2 instances access to AWS services:**

1. **IAM Role**: The correct way for EC2 instances to authenticate to AWS services is through an **IAM role**, not an IAM user. Roles provide temporary security credentials that are automatically rotated.

2. **Instance Profile**: An **instance profile** is the container that allows you to attach an IAM role to an EC2 instance. When you create a role for EC2 in the console, an instance profile with the same name is automatically created. The instance profile is what actually gets attached to the EC2 instance.

3. **Identity-based Policy**: You attach an identity-based policy (e.g., inline or managed policy) to the IAM role that grants `secretsmanager:GetSecretValue` permission

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips