Q32 — AWS SAA-C03 Ch.10

Question 32 of 100 | ← Chapter 10

Q632. A solutions architect is using an AWS CloudFormation template to deploy a three-tier web application. The web application consists of a web tier and an application tier that stores and retrieves user data in Amazon DynamoDB tables. The web and application tiers are hosted on Amazon EC2 instances, and the database tier is not publicly accessible. The application EC2 instances need to access the DynamoDB tables without exposing API credentials in the template.What should the solutions architect do to meet these requirements?

• A. Create an IAM role to read the DynamoDB tables. Associate the role with the application instances by referencing an instance profile.
• B. Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances ✓
• C. Use the parameter section in the AWS CloudFormation template to have the user input access and secret keys from an already-created IAM user that has the required permissions to read and write from the DynamoDB tables
• D. Create an IAM user in the AWS CloudFomation template that has the required permissions to read and write from the DynamoDB tables Use the GetAtt function to retrieve the access and secret keys, and pass them to the application instances through the user data

Correct Answer: B. Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances

Explanation

To meet the requirements of allowing the application EC2 instances to access the DynamoDB tables without exposing API credentials in the CloudFormation template, the most suitable solution would be:B. Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile and associate the instance profile with the application instances. Option B provides a secure and scalable approach to granting the application EC2 instances access to the DynamoDB tables without exposing API credentials. Here's how it can be implemented:\1. IAM Role: Create an IAM role that has the necessary permissions to read and write from the DynamoDB tables. This role should have an IAM policy attached that grants the required DynamoDB access permissions.\2. EC2 Instance Profile: Associate the IAM role with an EC2 instance profile. An instance profile is a container for an IAM role that can be associated with EC2 instances. By associating the IAM role with the instance profile, you grant the EC2 instances the permissions defined in the role. \3. Application Instances: Launch the application EC2 instances using the instance profile that contains the IAM role. This ensures that the instances have the necessary permissions to access the DynamoDB tables without exposing API credentials.Option A is not the best choice:A. Creating an IAM role to read the DynamoDB tables and associating the role with the application instances using an instance profile is the correct approach. However, option A incorrectly suggests referencing the instance profile within the CloudFormation template. Instead, the instance profile should be associated with the application instances when they are launched.Options C and D are not the best choices either:C. Using the parameter section in the CloudFormation template to have the user input access and secret keys from an already-created IAM user would expose API credentials in the template, which is not recommended for security reasons.D. Creating an IAM user in the CloudFormation template and retrieving the access and secret keys using the GetAtt function would also expose API credentials in the template, which is not a secure practice. Therefore, the most suitable solution for granting the application EC2 instances access to the DynamoDB tables without exposing API credentials in the CloudFormation template is to create an IAM role, add the role to the EC2 instance profile, and associate the instance profile with the application instances (option B).