SAA-C03 Q655 · IAM

Question

A company uses Amazon EC2 instances to host a website. The website uses an Amazon S3 bucket to store media files. The company wants to automate infrastructure creation across multiple Regions and securely grant EC2 access to S3 using IAM. Which solution will meet these requirements MOST securely?

Accepted Answer

Option C uses an **IAM role** attached to the EC2 instance via an **instance profile**, defined in **CloudFormation**. Here's why this satisfies every requirement:

1. **Automate infrastructure across multiple Regions**: CloudFormation templates are declarative and portable. You can deploy the same template in any Region, and it will create the IAM role, instance profile, and EC2 instances consistently.

2. **Securely grant EC2 access to S3**: IAM roles provide **temporary security credentials** that are automatically rotated by the AWS Security Token Service (STS). The EC2 instance retrieves these credentials from the **instance metadata service** — no long-lived access keys are ever stored on disk, in code, or in configuration files.

3. **Most secure approach**: This is the AWS-recommen

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips