How to enable cross-account EC2 access to a Kinesis data stream?

A developer is deploying an application on Amazon EC2 instances that run in Account A. The application needs to read data from an existing Amazon Kinesis data stream in Account B. Which actions should the developer take to provide the application with access to the stream? (Choose two.)

Update the instance profile role in Account A with stream read permissions.
Create an IAM role with stream read permissions in Account B. Source Reference Answer
Add a trust policy to the instance profile role and IAM role in Account B to allow the instance profile role to assume the IAM role. Source Reference Answer
Add a trust policy to the instance profile role and IAM role in Account B to allow reads from the stream.
Add a resource-based policy in Account B to allow read access from the instance profile role.

Community Votes

73%

27%

73% of anonymous learners picked answer BC. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests cross-account IAM role assumption for Kinesis access, where the common trap is confusing resource-based policies on the stream with identity-based trust policies on the target role.

This question tests cross-account access to an Amazon Kinesis data stream from an EC2 instance in another AWS account. The community consensus favors creating an IAM role in the target account and configuring a trust policy to allow the source account's instance profile role to assume it.

Many candidates choose BE, believing a resource-based policy on the Kinesis stream is required. While Kinesis supports resource-based policies, the exam scenario expects cross-account role assumption via a trust policy on a role in Account B.

Community Discussion (8 comments)

tullio85 👍 1

In the soltion C the EC2 istance is missing. I have to assume that it is reference to the EC2 istance.

bp07 👍 1 Selected: AE

B and C together could be part of the solution, but they still don't fully address the requirement because the Kinesis stream needs a resource-based policy to grant permission for cross-account access. Hence I feel AE will be answer.

examuserss 👍 1 Selected: BC

Selectec Answer: BC To allow an EC2 instance in one account (Account A) to access a Kinesis stream in another account (Account B), you need cross-account access. This is achieved by: Creating an IAM role in Account B: This role will have the necessary Kinesis read permissions. Adding a trust policy: This policy, added to the role in Account B, allows the EC2 instance's IAM role (in Account A) to assume the role in Account B. The EC2 instance's role then acts as a temporary security credential for accessing the Kinesis stream in Account B.

albert_kuo 👍 2 Selected: BC

create iam role { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kinesis:DescribeStream", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:ListStreams" ], "Resource": "arn:aws:kinesis:<region>:<AccountB-ID>:stream/<stream-name>" } ] }

YUICH 👍 1 Selected: AE

A. Update the instance profile role in Account A with the necessary permissions to read from the Kinesis stream. This allows the EC2 instance to assume the required permissions. E. Add a resource-based policy to the Kinesis stream in Account B to grant read access to the instance profile role in Account A. This enables cross-account access.

jasonczx 👍 4 Selected: BC

https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles

28304e5 👍 4 Selected: BE

C: This action involves cross-account role assumption, but for Kinesis access, you would typically use resource-based policies rather than cross-account role assumption unless the use case specifically involves assuming roles across accounts.

aragon_saa 👍 4 Selected: BC

Answer is BC

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

To allow an EC2 instance in Account A to read from an Amazon Kinesis data stream in Account B, the developer must configure cross-account IAM role assumption.

Correct Actions

B. Create an IAM role with stream read permissions in Account B. This role will contain an identity-based policy granting kinesis:GetRecords, kinesis:GetShardIterator, kinesis:DescribeStream, and kinesis:ListStreams on the target stream ARN.

C. Add a trust policy to the IAM role in Account B to allow the instance profile role to assume it. The trust policy (assume-role policy) on the Account B role must specify the instance profile role ARN from Account A as a trusted principal. The EC2 instance's application code then calls sts:AssumeRole to obtain temporary credentials.

Note: The option wording mentions adding a trust policy to both the instance profile role and the Account B role. In practice, only the target role (Account B) needs a trust policy; the source role (Account A instance profile) only needs permission to call sts:AssumeRole. However, the exam treats this option as correct because it captures the trust relationship concept.

Why Other Options Are Wrong

A is partially true (the instance profile role needs sts:AssumeRole permission), but it does not by itself grant cross-account stream access without the Account B role.
D is incorrect because a trust policy does not grant data-plane permissions like stream reads; it only controls who can assume the role.
E is a plausible alternative since Kinesis does support resource-based policies, but the exam's intended pattern is cross-account role assumption (B + C), as confirmed by the majority of community voters and AWS security blog references.

Official Reference

Exam Strategy

When you see cross-account access questions involving EC2 and a managed service, first check whether the service supports resource-based policies. If the options include both role assumption and resource-based policy, favor the cross-account role assumption pattern (create role + trust policy) unless the question explicitly mentions a resource-based policy requirement.

Related Analysis

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide