Q89 — AWS SAA-C03 Ch.16

Question 89 of 100 | ← Chapter 16

Q1289. A company runs an application on Amazon EC2 instances. The application needs to access an Amazon RDS database. The company wants to grant the EC2 instances access permissions to the RDS database while following the principle of least privilege.Which solution will meet these requirements?

Correct Answer: D. Create an IAM role that has a policy that grants the minimum required permissions to access the RDS database. Attach the IAM role to an EC2 instance profile. Associate the instance profile with the instances.

Explanation

The correct solution must grant EC2 instances access to an Amazon RDS database while adhering to the principle of least privilege (minimum necessary permissions) and avoiding hardcoded credentials. Let's evaluate each option:Correct Answer: D. Create an IAM role that has a policy that grants the minimum required permissions to access the RDS database. Attach the IAM role to an EC2 instance profile. Associate the instance profile with the instances.Why Option D is Best:Follows the Principle of Least Privilege:The IAM role is configured with only the permissions needed to access RDS (e.g., rds-db:connect or specific database actions).Avoids over-permissioned policies (unlike Option A, which grants admin access).No Hardcoded Credentials (Most Secure):IAM roles for EC2 provide temporary security tokens automatically rotated by AWS. No need to embed access keys in code or configuration files (unlike Options A/B).Proper AWS Integration:EC2 instance profiles are the recommended way to assign IAM roles to instances. Applications running on EC2 can use the AWS SDK or CLI to authenticate with RDS via the role's temporary credentials.Why Other Options Fail:A. Create an IAM user that has a policy that grants administrative permissions. Use the IAM user's access keys on the EC2 instances to access the RDS database.Highly Insecure:Admin permissions violate least privilege (grants unnecessary access). Hardcoded access keys are a security risk (if leaked, attackers gain full AWS access). B. Create an IAM user that has a policy that grants the minimum required permissions to access the RDS database. Embed the IAM user's access keys on the EC2 instances to access the RDS database.Still Insecure:While least privilege is applied, hardcoded access keys remain a security vulnerability (keys can be exposed in logs, repos, or memory dumps).C. Create an IAM role that has a policy that grants the minimum required permissions to access the RDS database. Attach the IAM role access key and the IAM role secret key to the EC2 instance profile.Incorrect Understanding of IAM Roles:IAM roles do not require manual access keys--AWS automatically manages temporary credentials. This approach is invalid (instance profiles cannot be manually assigned static keys).Key Comparison:RequirementOption DOther OptionsLeast privilege permissions(Role with minimal RDS access) (A: Admin; B: Minimal but hardcoded keys; C:Misconfigured role)No hardcoded credentials(Automatic credential rotation via role) (A/B: Embedded keys; C: Invalid approach)Proper AWS security practices(IAM roles + instance profiles) (A/B: IAM users + keys; C: Misunderstanding roles)How Option D Works in Practice:Create an IAM Role with a policy like:json{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["rds-db:connect"],"Resource": "arn:aws:rds:us-east-1:123456789012:dbuser:my-db-instance/*" }]}Attach the role to an EC2 instance profile.Associate the instance profile with EC2 instances.Applications on EC2 use the AWS SDK to authenticate with RDS (credentials fetched automatically from the role).Conclusion:Option D is the only solution that:Grants least privilege permissions.Avoids hardcoded credentials.Follows AWS security best practices.Final Answer: D