Q60 — AWS SAA-C03 Ch.16

Question 60 of 100 | ← Chapter 16

Q1260. A solutions architect is using Amazon EC2 instances to host an application. The solutions architect needs to grant permissions for the application to access an Amazon DynamoDB table.Which solution will meet this requirement?

• A. Create access keys to access the DynamoDB table. Assign the access keys to the EC2 instance profile.
• B. Create an EC2 key pair to access the DynamoDB table. Assign the key pair to the EC2 instance profile.
• C. Create an IAM user to access the DynamoDB table. Assign the IAM user to the EC2 instance profile.
• D. Create an IAM role to access the DynamoDB table.Assign the IAM role to the EC2 instance profile. ✓

Correct Answer: D. Create an IAM role to access the DynamoDB table.Assign the IAM role to the EC2 instance profile.

Explanation

The correct answer is D. Create an IAM role to access the DynamoDB table. Assign the IAM role to the EC2 instance profile.Explanation:The best practice for granting AWS service permissions (like EC2 accessing DynamoDB) is to use IAM roles instead of static credentials (access keys) or IAM users. This ensures:Security: No hardcoded credentials in the application.Automatic credential rotation: AWS handles temporary credentials. Least privilege: Fine-grained permissions via IAM policies.Why Option D is Correct:IAM Role:A role is an AWS identity with permissions policies.Trust policy allows EC2 to assume the role.Permission policy grants access to DynamoDB.EC2 Instance Profile:A container for an IAM role that EC2 instances can assume. Automatically provides temporary credentials to the application via the instance metadata service (IMDS).Best Practice:Avoids storing access keys in code or configuration.Simplifies credential management (no rotation needed).Why the Other Options Are Incorrect:A. Create access keys & assign to EC2 instance profileAccess keys are static credentials, which are insecure (risk of leakage).Not recommended for EC2-to-AWS-service access.B. Create an EC2 key pair & assign to instance profileEC2 key pairs are for SSH access, not AWS API permissions.Irrelevant to DynamoDB access.C. Create an IAM user & assign to EC2 instance profileIAM users are for humans, not services (EC2).Still requires access keys, which are less secure than roles.How to Implement Option D:Create an IAM Role:In the AWS Console, go to IAM Roles Create Role.Select AWS service EC2 as the trusted entity.Attach a policy (e.g., AmazonDynamoDBFullAccess or a custom policy).Assign the Role to an EC2 Instance Profile:When launching an EC2 instance, select the role in the IAM role dropdown. For existing instances, attach the role via Actions Instance Settings Attach/Replace IAM Role.Application Access:The application retrieves temporary credentials from the instance metadata service (IMDS).No manual credential management is needed.Conclusion:Option D is the most secure and scalable solution because:IAM roles provide temporary, rotating credentials.No static access keys are stored on EC2.Follows AWS best practices for service-to-service authentication.Final Answer:D