How to securely grant EC2 instances least-privilege access to multiple S3 buckets?
Short answer
B Associate the EC2 instance with an IAM role that has an IAM policy that allows s3:ListBucket and s3:*Object permissions for specific S3 buckets.
Question
Key Takeaways
The question tests whether you can eliminate hard-coded credentials and scope permissions to specific buckets and actions, which is the essence of least privilege on AWS.
This question tests the use of IAM roles attached to EC2 instances to provide secure, credential-free access to multiple S3 buckets while enforcing the principle of least privilege. The community unanimously agrees that option B is correct.
Common mistake: Candidates often choose option C (AmazonS3FullAccess) because it is easy to implement, but it grants access to every S3 bucket in the account, violating the principle of least privilege.
Expert Analysis
Why Option B is Correct
Option B satisfies all three requirements stated in the scenario:
1. No credential management: By attaching an IAM role to the EC2 instance, the AWS SDK automatically retrieves short-lived credentials from the instance metadata service. The developer never needs to create, rotate, or store access keys.
2. Principle of least privilege: The policy explicitly limits actions to s3:ListBucket and s3:*Object only on specific S3 buckets. This is the narrowest permission set that still allows the application to function.
3. Multiple buckets: The policy can list multiple bucket ARNs in the Resource element, cleanly supporting the multi-bucket requirement.
Why the Other Options Fail
- Option A creates an IAM user with access keys. This violates the requirement of not managing credentials and also uses
s3:*, which is far broader than necessary. - Option C uses the AmazonS3FullAccess AWS managed policy. While it does use an IAM role (good), the managed policy grants full S3 access across all buckets, completely ignoring least privilege.
- Option D proposes a bucket policy referencing the EC2 instance. Bucket policies can reference IAM principals, but an EC2 instance itself is not an IAM principal—its IAM role is. Moreover, managing policies on every bucket is operationally painful and still does not address credential management.
Community Consensus
All voters selected B, with commenters noting that option C fails because it does not scope permissions to the specific buckets mentioned in the scenario.
Official Reference
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-iam.html
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question mentions 'no credential management' on an EC2 instance, immediately think IAM role for EC2. Then check whether the remaining options actually enforce least privilege by scoping actions and resources; the narrowest scope wins.
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
ANDRES715 👍 1Habla de varios depositos S3 por eso la opcion correcta es la B ya que C no especifica cada deposito, habla de solo uno.
-
65703c1 👍 3 Answered BB is the correct answer.
-
CrescentShared 👍 3 Answered BB is correct.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →