On-Premises Access to S3 via IAM Roles Anywhere

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Use IAM Roles Anywhere to enable on-premises virtual machines to assume an IAM role for temporary, secure access to the S3 bucket.

Question

A company has an Amazon S3 bucket that contains sensitive data files. The company has an application that runs on virtual machines in an on-premises data center. The company currently uses AWS IAM Identity Center. The application requires temporary access to files in the S3 bucket. The company wants to grant the application secure access to the files in the S3 bucket. Which solution will meet these requirements?
  1. Create an S3 bucket policy that permits access to the bucket from the public IP address range of the company’s on-premises data center.
  2. Use IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to the S3 bucket. Configure the virtual machines to assume the role by using the AWS CLI. Correct Answer
  3. Install the AWS CLI on the virtual machine. Configure the AWS CLI with access keys from an IAM user that has access to the bucket.
  4. Create an IAM user and policy that grants access to the bucket. Store the access key and secret key for the IAM user in AWS Secrets Manager. Configure the application to retrieve the access key and secret key at startup.

Key Takeaways

The question tests hybrid identity management; the trap is using static credentials or IP-based policies instead of a service designed for non-AWS workloads.

IAM Roles Anywhere enables on-premises applications to assume AWS IAM roles for temporary, secure access to S3 buckets without managing long-term credentials.

Common mistake: Candidates often choose storing keys in Secrets Manager (D) because it seems secure, but it still relies on long-term static credentials which are less secure than temporary role sessions.

Expert Analysis

Why the Answer Is Correct

IAM Roles Anywhere is specifically designed to allow workloads running outside of AWS (like on-premises VMs) to use IAM roles to access AWS resources. It leverages X.509 certificates for authentication and issues temporary security credentials, aligning with the requirement for secure, temporary access. Since the company already uses IAM Identity Center, integrating Roles Anywhere provides a unified identity management approach.

Why the Other Options Are Wrong

Option A is insecure as IP-based policies are easily spoofed and do not provide identity-based access control. Option C involves long-term static access keys, which violate best practices for security and require manual rotation. Option D stores long-term keys in Secrets Manager; while better than hardcoding, it still requires managing static credentials and does not offer the automatic short-lived session benefits of IAM roles.

Community Comment Notes

Community consensus strongly supports B, noting that Roles Anywhere allows on-prem servers to obtain temporary credentials securely. As one user noted, "AM Roles Anywhere allows on-premises servers and applications to obtain temporary AWS credentials," highlighting the avoidance of long-term keys.

Exam Strategy

Always look for services that bridge on-premises and cloud identities when 'temporary' and 'secure' are key requirements; prioritize IAM Roles Anywhere over static key management for hybrid scenarios.

Frequently Asked Questions

Why not store S3 access keys in Secrets Manager?

Secrets Manager stores long-term static credentials. IAM Roles Anywhere provides short-lived temporary credentials, reducing risk if compromised.

Does IAM Roles Anywhere integrate with IAM Identity Center?

Yes, it can be configured to trust certificates issued by your existing identity provider, including those managed via IAM Identity Center.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Bwhizzy 👍 3 Answered B
    Answer is B. AM Roles Anywhere allows on-premises servers and applications to obtain temporary AWS credentials and access AWS resources securely. This solution allows your on-premises virtual machines to use IAM roles without needing long-term credentials (like access keys). The virtual machines can assume roles and access the S3 bucket temporarily and securely. Since the company is already using AWS IAM Identity Center, using IAM Roles Anywhere allows the company to leverage its existing Identity Center setup while following AWS best practices for security. This approach ensures the application can securely retrieve credentials without embedding static credentials into the application.
  2. FlyingHawk 👍 2 Answered B
    You can use AWS Identity and Access Management Roles Anywhere to obtain temporary security credentials in IAM for workloads such as servers, containers, and applications that run outside of AWS. Your workloads can use the same IAM policies and IAM roles that you use with AWS applications to access AWS resources. Using IAM Roles Anywhere means you don't need to manage long-term credentials for workloads running outside of AWS. https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html
  3. LeonSauveterre 👍 1 Answered B
    You have sensitive data in an S3 bucket, and an on-premises application needs temporary access. The solution must be secure and leverage IAM Identity Center (already in use), so now we need to grant temporary and secure credentials to the application while avoiding static credentials (like access keys). A - IP-based access lacks identity verification, leaving the bucket vulnerable to IP spoofing. B - This way you’re not introducing static credentials or deviating from your existing centralized identity setup. C - Manually managing credentials for multiple machines or applications is a hassle. D - Requires additional setup (Secrets Manager integration) and introduces ongoing costs. Also, the underlying issue (static credentials) is still there.
  4. aragon_saa 👍 2 Answered B
    Answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide