SAA-C03 Q349 · IAM

Question

A company runs an application on Amazon EC2 instances. The application needs to access an Amazon RDS database. The company wants to grant the EC2 instances access permissions to the RDS database while following the principle of least privilege. Which solution will meet these requirements?

Accepted Answer

Option D is correct because it follows AWS best practices on multiple levels:

1. **Uses IAM Role, not IAM User**: IAM roles are the recommended way to grant permissions to AWS services (like EC2). Roles provide temporary security credentials that are automatically rotated — no long-lived access keys to manage or risk leaking.

2. **Minimum required permissions**: The policy attached to the role grants only the permissions needed to access the RDS database, satisfying the **principle of least privilege**.

3. **EC2 Instance Profile**: This is the correct mechanism to associate an IAM role with an EC2 instance. An instance profile is a container for an IAM role that allows EC2 instances to assume that role. When you attach a role to an instance profile and associate the instance profile wit

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips