CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate Exam Question Walkthrough: EC2 and S3 Permissions
Understanding how to give EC2 instances permissions for S3 access is crucial for the SAA-C03 exam. Let's break down a common question.
An EC2 instance must read from an S3 bucket. Following best practices, how should the instance obtain permissions?
A. Store IAM access keys in a file on the instance
B. Attach an IAM role (instance profile) with an S3 read policy to the instance
C. Hardcode credentials in the application code
D. Use the root account access keys
Think before you scroll
This question tests your understanding of AWS security best practices. Remember that managing permissions effectively is essential for maintaining a secure architecture. Focus on how AWS recommends granting access to resources without compromising security.
The answer
The correct option is B: Attach an IAM role (instance profile) with an S3 read policy to the instance. This method allows the instance to access the S3 bucket securely using temporary credentials that AWS provides automatically, adhering to security best practices.
Why the other options lose
A. Store IAM access keys in a file on the instance: This approach is insecure. It risks exposing static credentials if the instance is compromised. AWS best practices advise against storing access keys on instances.
C. Hardcode credentials in the application code: Hardcoding credentials in code increases the risk of accidental exposure, especially if the code is shared or stored in version control. AWS recommends using IAM roles instead.
D. Use the root account access keys: Using root account access keys is a poor security practice. The root account should be reserved for account management and not for routine tasks like application access. This option violates the principle of least privilege.
The concept behind it
The principle of least privilege ensures that entities only have the permissions they need. By using IAM roles with instance profiles, you grant the EC2 instance the necessary access to S3 without exposing static credentials. Temporary credentials provided by AWS help reduce security risks.
Exam trap to remember
Always prefer IAM roles for EC2 instances. Static credentials are a security risk and should be avoided.