How to Securely Grant EC2 Application Access to S3?
A company wants to migrate applications from its on-premises servers to AWS. As a first step, the company is modifying and migrating a non-critical application to a single Amazon EC2 instance. The application will store information in an Amazon S3 bucket. The company needs to follow security best practices when deploying the application on AWS. Which approach should the company take to allow the application to interact with Amazon S3?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests secure AWS authentication mechanisms, with the common trap being the selection of hardcoded IAM user credentials instead of temporary credentials managed by IAM roles.
This question evaluates secure credential management for EC2-to-S3 communication using IAM roles versus static IAM user keys. Community consensus confirms that attaching a least-privilege IAM role to the EC2 instance is the definitive AWS security best practice.
Option D is the primary distractor; candidates frequently select it because it explicitly mentions 'necessary access,' but they overlook that embedding static access keys in application code violates security standards and creates significant credential exposure risks.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Attaching an IAM role to an EC2 instance enables the application to automatically retrieve temporary security credentials through the Instance Metadata Service (IMDS). This method completely removes the burden of managing long-term secrets and drastically reduces the attack surface. Additionally, the attached policy can be tightly scoped to only the required S3 actions, perfectly satisfying the principle of least privilege.Why the Other Options Are Wrong
Option A grants full administrative privileges, which directly contradicts least privilege principles and endangers the entire AWS account. Options B and D both mandate hardcoding IAM user access keys within the application source code, making key rotation difficult and increasing the likelihood of accidental exposure in version control systems. AWS explicitly discourages this pattern for any workload running on EC2.Community Comment Notes
The community overwhelmingly validates Option C, highlighting that IAM roles automatically handle credential rotation and secure delivery without manual steps [1]. Contributors repeatedly stress that this architecture aligns directly with AWS security guidelines while enforcing strict permission boundaries [2, 3]. Several comments explicitly warn against storing keys in code, reinforcing why the other choices fail the security best practice requirement.Official Reference
Exam Strategy
Always prioritize IAM roles over IAM users when enabling AWS services or EC2 instances to interact with other AWS resources. Scan the question for phrases like 'security best practices' or 'least privilege' to instantly eliminate options containing hardcoded credentials or overly broad administrative policies.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →