How to Securely Grant EC2 Access to S3?
A developer designed an application on an Amazon EC2 instance. The application makes API requests to objects in an Amazon S3 bucket. Which combination of steps will ensure that the application makes the API requests in the MOST secure manner? (Choose two.)
Community Votes
100% of anonymous learners picked answer BC. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you know to use temporary credentials from an IAM role via an instance profile instead of long-lived IAM user keys, even if the IAM user has correct S3 permissions.
For the DVA-C02 exam, the community confirms that using an IAM role attached to an EC2 instance profile (options B and C) is the most secure way for an EC2 application to access S3. Avoid IAM user credentials or environment variables because they are long-lived and less secure.
Choosing A or E, which store long-lived IAM user credentials on the EC2 instance; these are less secure and not a recommended best practice because they can be compromised and require key management.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B creates an IAM role that grants permissions to the S3 bucket, removing the need for long-lived access keys. Option C attaches that role to the EC2 instance through an instance profile, allowing the application to automatically obtain temporary credentials from the instance metadata service. This is AWS's recommended best practice for granting permissions to applications running on EC2.
Why the Other Options Are Wrong
Option A creates an IAM user with S3 permissions and puts the user in a group, but that still leaves you with access keys that must be stored and managed. Option D assigns the role to an IAM group, but IAM roles are not assigned to groups; they are assumed by entities like users or instances. Option E stores IAM user credentials in environment variables, which is explicitly unsafe because they can be exposed in logs, snapshots, or through the instance metadata.
Community Comment Notes
All three comments vote BC as the correct answer, with likes of 2, 3, and 1 respectively. Comment [2] simply states 'BC is correct,' and comment [3] affirms it. One comment discusses static website hosting and CloudFront, which is unrelated to the question's focus on EC2 identity and S3 access, so it should be ignored in this context.
Official Reference
Exam Strategy
When you see EC2 + S3 API access, immediately think IAM role + instance profile. Never store IAM user credentials on an instance unless the question explicitly requires it, as the most secure approach always uses temporary credentials.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →