SAA-C03 practice question: IAM roles and policies (1 of 3)

Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A logistics company runs a nightly invoicing application on Amazon EC2 instances in an Auto Scaling group. The application reads delivery records from one Amazon S3 bucket and writes finished invoices to a second bucket. Other applications run in the same VPC and must not be able to use either bucket. The security team bans long-term access keys on instances and in code, and wants permissions kept to the minimum the application needs. Which solution meets these requirements MOST securely?

Choose one answer.

A. Create an IAM user with a policy for both buckets, store its access key in AWS Secrets Manager, and have the application fetch the key at startup.
B. Attach an instance profile to the launch template with an IAM role that allows s3:GetObject on the source bucket and s3:PutObject on the invoice bucket.
C. Attach an instance profile to the launch template with an IAM role that has the AWS managed AmazonS3FullAccess policy, so the application can reach both buckets.
D. Create an S3 gateway endpoint, and add bucket policies that allow any principal whose requests arrive through that endpoint, so the instances need no credentials.

Show the answer and explanation

Answer: B

A. Wrong: Secrets Manager protects the key at rest, but an IAM user access key is still a long-term credential that the application holds in memory and that someone must rotate. The security team has banned long-term access keys. An IAM role delivered through an instance profile gives temporary credentials instead. Learn more: Security best practices in IAM (opens in a new tab)
B. Right: Correct. The instance profile gives the application temporary role credentials through instance metadata, and they are refreshed automatically before they expire, so no access key is stored anywhere. The policy names only the two actions on the two buckets the application uses, which is least privilege. Learn more: Use an IAM role to grant permissions to applications running on Amazon EC2 instances (opens in a new tab)
C. Wrong: The role removes long-term keys, so half of the requirement is met. However, AmazonS3FullAccess grants every S3 action on every bucket in the account, far more than the application needs. AWS recommends replacing broad managed policies with a customer managed policy scoped to the task. Learn more: Security best practices in IAM (opens in a new tab)
D. Wrong: The aws:SourceVpce condition checks only the network path, not who is calling. Any workload in the VPC that routes through the endpoint would get the same access, which breaks the rule that other applications must not use the buckets. Identity-based access with an IAM role is needed. Learn more: Controlling access from VPC endpoints with bucket policies (opens in a new tab)

Explanation

An IAM role attached through an instance profile is the standard way to give an EC2 application AWS permissions without long-term keys: the credentials are temporary and rotate automatically. Scoping the role's policy to s3:GetObject on the source bucket and s3:PutObject on the invoice bucket keeps permissions to the minimum and keeps other workloads in the VPC out, which a network-only condition cannot do.

SAA-C03 practice question: IAM roles and policies (1 of 3)

Explanation

Study

Keep practising