How to securely grant EC2 instances least-privilege access to multiple S3 buckets?

Why Option B is Correct

Option B satisfies all three requirements stated in the scenario:

1. No credential management: By attaching an IAM role to the EC2 instance, the AWS SDK automatically retrieves short-lived credentials from the instance metadata service. The developer never needs to create, rotate, or store access keys. 2. Principle of least privilege: The policy explicitly limits actions to s3:ListBucket and s3:*Object only on specific S3 buckets. This is the narrowest permission set that still allows the application to function. 3. Multiple buckets: The policy can list multiple bucket ARNs in the Resource element, cleanly supporting the multi-bucket requirement.

Why the Other Options Fail

• Option A creates an IAM user with access keys. This violates the requirement of not managing credentials and also uses s3:*, which is far broader than necessary.
• Option C uses the AmazonS3FullAccess AWS managed policy. While it does use an IAM role (good), the managed policy grants full S3 access across all buckets, completely ignoring least privilege.
• Option D proposes a bucket policy referencing the EC2 instance. Bucket policies can reference IAM principals, but an EC2 instance itself is not an IAM principal—its IAM role is. Moreover, managing policies on every bucket is operationally painful and still does not address credential management.

Community Consensus

All voters selected B, with commenters noting that option C fails because it does not scope permissions to the specific buckets mentioned in the scenario.