Q84 — AWS SAA-C03 Ch.15

Question 84 of 100 | ← Chapter 15

Q1184. A company uses a set of Amazon EC2 instances to host a website. The website uses an Amazon S3 bucket to store images and media files.The company wants to automate website infrastructure creation to deploy the website to multiple AWS Regions.The company also wants to provide the EC2 instances access to the S3 bucket so the instances can store and access data by using AWS Identity and Access Management (IAM).Which solution will meet these requirements MOST securely?

• A. Create an AWS CloudFormation template for the web server EC2 instances. Save an IAM access key in the UserData section of the AWS::EC2::Instance entity in the CloudFormation template.
• B. Create a file that contains an IAM secret access key and access key ID.Store the file in a new S3 bucket. Create an AWS CloudFormation template. In the template, create a parameter to specify the location of the S3 object that contains the access key and access key ID.
• C. Create an IAM role and an IAM access policy that allows the web server EC2 instances to access the S3 bucket. Create an AWS CloudFormation template for the web server EC2 instances that contains an IAM instance profile entity that references the IAM role and the IAM access policy. ✓
• D. Create a script that retrieves an IAM secret access key and access key ID from IAM and stores them on the web server EC2 instances. Include the script in the UserData section of the AWS::EC2::Instance entity in an AWS CloudFormation template.

Correct Answer: C. Create an IAM role and an IAM access policy that allows the web server EC2 instances to access the S3 bucket. Create an AWS CloudFormation template for the web server EC2 instances that contains an IAM instance profile entity that references the IAM role and the IAM access policy.

Explanation

To meet the requirements of automating website infrastructure creation across multiple AWS Regions while securely providing EC2 instances access to an Amazon S3 bucket, the most secure solution is C. Create an IAM role and an IAM access policy that allows the web server EC2 instances to access the S3 bucket. Create an AWS CloudFormation template for the web server EC2 instances that contains an IAM instance profile entity that references the IAM role and the IAM access policy.Analysis of Options:Option A: Create an AWS CloudFormation template for the web server EC2 instances. Save an IAM access key in the UserData section of the AWS::EC2::Instance entity in the CloudFormation template. Limitation: Storing IAM access keys directly in the CloudFormation template's UserData section is insecure. Access keys are long-term credentials that, if compromised, could lead to unauthorized access to AWS resources. This approach violates the principle of least privilege and increases the risk of credential exposure.Option B: Create a file that contains an IAM secret access key and access key ID. Store the file in a new S3 bucket. Create an AWS CloudFormation template. In the template, create a parameter to specify the location of the S3 object that contains the access key and access key ID. Limitation: This solution also involves storing IAM access keys in an S3 bucket, which is insecure. Access keys should never be stored in plain text or in easily accessible locations. This approach increases the risk of credential theft and unauthorized access.Option C: Create an IAM role and an IAM access policy that allows the web server EC2 instances to access the S3 bucket. Create an AWS CloudFormation template for the web server EC2 instances that contains an IAM instance profile entity that references the IAM role and the IAM access policy. Advantage: This solution uses IAM roles and instance profiles, which are the most secure way to grant temporary credentials to EC2 instances. IAM roles provide temporary security credentials that are automatically rotated and do not require the storage of long-term access keys. The IAM access policy can be finely tuned to grant only the necessary permissions to the EC2 instances, adhering to the principle of least privilege. This approach is secure, scalable, and easy to manage. Option D: Create a script that retrieves an IAM secret access key and access key ID from IAM and stores them on the web server EC2 instances. Include the script in the UserData section of the AWS::EC2::Instance entity in an AWS CloudFormation template. Limitation: Similar to Option A, this solution involves storing IAM access keys on the EC2 instances, which is insecure. Access keys should not be stored on instances or in scripts, as this increases the risk of credential exposure and unauthorized access.