Q48 — AWS SAA-C03 Ch.17

Question 48 of 89 | ← Chapter 17

Q1348. A company runs several applications on Amazon EC2 instances. The company stores configuration files in an Amazon S3 bucket.A solutions architect must provide the company's applications with access to the configuration files. The solutions architect must follow AWS best practices for security.Which solution will meet these requirements?

Correct Answer: C. Use an IAM role to grant the necessary permissions to the applications.

Explanation

The correct solution is C. Use an IAM role to grant the necessary permissions to the applications.Explanation:Requirement:Applications running on Amazon EC2 instances need secure access to configuration files stored in an Amazon S3 bucket.The solution must follow AWS best practices for security, which means avoiding hardcoded credentials and using the principle of least privilege.Why Option C is correct:IAM Roles for EC2 Instances:IAM roles allow EC2 instances to obtain temporary AWS credentials automatically (via the instance metadata service).No need to manage or store static access keys in the application code or configuration files. Permissions can be finely controlled using IAM policies attached to the role.AWS Best Practices:AWS strongly recommends using IAM roles instead of long-term credentials (access keys) for EC2 instances.This approach is more secure and easier to manage (e.g., rotating credentials automatically).Why the other options are incorrect:A. Use the AWS account root user access keysHighly insecure: The root user has full access to all AWS resources, and its credentials should never be used in applications.Violates the principle of least privilege and increases the risk of catastrophic breaches.B. Use the AWS access key ID and the EC2 secret access keyInsecure: Hardcoding or storing static access keys in application code or configuration files is a security risk (keys can be leaked or stolen).AWS recommends avoiding long-term credentials for EC2 instances in favor of IAM roles. D. Activate multi-factor authentication (MFA) and versioning on the S3 bucket Not relevant: While MFA and versioning improve S3 bucket security, they do not provide a way for EC2 applications to authenticate and access the bucket.This option addresses data protection, not application access control.Correct Approach (Option C):Create an IAM Role with permissions to read the S3 bucket (e.g., s3:GetObject). Attach the IAM Role to the EC2 Instance (via the AWS Management Console, CLI, or SDK). Applications on the EC2 instance can then use the AWS SDK or CLI to access the S3 bucket without needing explicit credentials (the SDK retrieves temporary credentials from the instance metadata).Example IAM Policy for the Role:json{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["s3:GetObject"],"Resource": ["arn:aws:s3:::your-config-bucket/"]}]}Conclusion:Option C is the only secure and AWS-recommended solution for granting EC2 applications access to S3 resources. It eliminates the need for hardcoded credentials and follows the principle of least privilege.