Question
According to security best practices, how should an Amazon EC2 instance be given access to an Amazon S3 bucket?
- A. Hard code an IAM user’s secret key and access key directly in the application, and upload the file.
- B. Store the IAM user’s secret key and access key in a text file on the EC2 instance, read the keys, then upload the file.
- C. Have the EC2 instance assume a role to obtain the privileges to upload the file. Correct
- D. Modify the S3 bucket policy so that any service can upload to it at any time.
Explanation
According to AWS security best practices, hardcoding credentials or storing them in files is insecure (ruling out options A and B). Modifying an S3 bucket policy to allow any service to upload at any time increases the risk of unauthorized access (ruling out option D). The correct approach is for the EC2 instance to assume a role with specific permissions, which provides secure, controlled access to the S3 bucket.
