SAA-C03 Q79 · IAM

Question

A company runs several applications on Amazon EC2 instances. The company stores configuration files in an Amazon S3 bucket. A solutions architect must provide the company's applications with access to the configuration files. The solutions architect must follow AWS best practices for security. Which solution will meet these requirements?

Accepted Answer

**Option C: Use an IAM role to grant the necessary permissions to the applications.**

This is the AWS best practice for granting EC2 instances access to other AWS services. Here's why:

1. **No hardcoded credentials**: IAM roles attached to EC2 instances (via instance profiles) provide **temporary security credentials** that are automatically rotated. The EC2 instance metadata service delivers these credentials to the application.

2. **Principle of least privilege**: An IAM role can be configured with a policy that grants **only the specific S3 permissions needed** (e.g., `s3:GetObject` on the specific bucket/prefix), nothing more.

3. **Automatic credential management**: The AWS SDK on the EC2 instance automatically retrieves and refreshes temporary credentials from the instance metadat

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips