SAA-C03 Q561 · IAM

Question

A company runs an application on Amazon EC2 instances. The instances need to access an Amazon RDS database by using specific credentials. The company uses AWS Secrets Manager to contain the credentials the EC2 instances must use. Which solution will meet this requirement?

Accepted Answer

**Answer A** is correct because it follows the AWS best practice pattern for granting EC2 instances access to AWS services:

1. **IAM Role creation**: An IAM role is the correct identity type for EC2 instances. Roles provide temporary credentials that are automatically rotated — no need to embed long-term credentials.

2. **Instance Profile attachment**: An EC2 instance profile is the container that allows you to attach an IAM role to an EC2 instance. The instance profile is the bridge between EC2 and IAM. When you attach a role to an instance profile, the EC2 instance can assume that role.

3. **Identity-based policy**: An identity-based policy attached to the IAM role grants `secretsmanager:GetSecretValue` permission on the specific secret ARN. This is the standard approach — the policy

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips