How to Securely Grant EC2 Access to S3?

DVA-C02 By islever Editorial Last updated

Short answer

BC Create an IAM role that has permissions to the S3 bucket. Add the IAM role to an instance profile. Attach the instance profile to the EC2 instance.

Question

A developer designed an application on an Amazon EC2 instance. The application makes API requests to objects in an Amazon S3 bucket. Which combination of steps will ensure that the application makes the API requests in the MOST secure manner? (Choose two.)
  1. Create an IAM user that has permissions to the S3 bucket. Add the user to an IAM group.
  2. Create an IAM role that has permissions to the S3 bucket. Correct Answer
  3. Add the IAM role to an instance profile. Attach the instance profile to the EC2 instance. Correct Answer
  4. Create an IAM role that has permissions to the S3 bucket. Assign the role to an IAM group.
  5. Store the credentials of the IAM user in the environment variables on the EC2 instance.

Key Takeaways

The exam tests whether you know to use temporary credentials from an IAM role via an instance profile instead of long-lived IAM user keys, even if the IAM user has correct S3 permissions.

For the DVA-C02 exam, the community confirms that using an IAM role attached to an EC2 instance profile (options B and C) is the most secure way for an EC2 application to access S3. Avoid IAM user credentials or environment variables because they are long-lived and less secure.

Common mistake: Choosing A or E, which store long-lived IAM user credentials on the EC2 instance; these are less secure and not a recommended best practice because they can be compromised and require key management.

Expert Analysis

Why the Answer Is Correct

Option B creates an IAM role that grants permissions to the S3 bucket, removing the need for long-lived access keys. Option C attaches that role to the EC2 instance through an instance profile, allowing the application to automatically obtain temporary credentials from the instance metadata service. This is AWS's recommended best practice for granting permissions to applications running on EC2.

Why the Other Options Are Wrong

Option A creates an IAM user with S3 permissions and puts the user in a group, but that still leaves you with access keys that must be stored and managed. Option D assigns the role to an IAM group, but IAM roles are not assigned to groups; they are assumed by entities like users or instances. Option E stores IAM user credentials in environment variables, which is explicitly unsafe because they can be exposed in logs, snapshots, or through the instance metadata.

Community Comment Notes

All three comments vote BC as the correct answer, with likes of 2, 3, and 1 respectively. Comment [2] simply states 'BC is correct,' and comment [3] affirms it. One comment discusses static website hosting and CloudFront, which is unrelated to the question's focus on EC2 identity and S3 access, so it should be ignored in this context.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see EC2 + S3 API access, immediately think IAM role + instance profile. Never store IAM user credentials on an instance unless the question explicitly requires it, as the most secure approach always uses temporary credentials.

Community Votes

BC
100%

100% of anonymous learners picked answer BC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Saurabh04 👍 2
    Option B (Amazon S3 Static Website Hosting): Enable static website hosting on the S3 bucket. Specify index.html as the Index document. Update the S3 bucket policy to allow access. Configure the CloudFront distribution’s origin to use the S3 website endpoint. Pros: Handles both root and subdirectories. Keeps the S3 bucket private. Cons: Requires S3 bucket policy adjustments. Verdict: Recommended solution. Option C (CloudFront Function for Directory Indexes): Create a CloudFront function that appends index.html to request URLs for directories. Add this function as a viewer request CloudFront function. Pros: Customizable behavior. Works for subdirectories. Cons: Adds complexity. Verdict: Suitable if you need custom logic
  2. CrescentShared 👍 3
    BC is correct
  3. 65703c1 👍 1
    BC is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide