SCS-C03 practice question: Instance profiles, service roles and execution roles
Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A payments startup runs a fleet of worker instances on Amazon EC2. The workers read files from Amazon S3 and call a database. The engineers want no long-term access key stored on any instance, and the security team wants administrators to reach the instances without any inbound SSH port.
Match each requirement to the access method that meets it. Each option is used at most once, and one option is not needed.
Match each item to one answer. An answer can be used more than once, and some may not be used.
Items
The worker code must read objects from the job bucket, with no credential stored on the instance or in its code.
The worker must read a database password that rotates every 30 days, without a code change.
The administrators need an audited shell on a worker, without an inbound SSH port or a shared key.
The bucket owner must allow only the worker role, and no other role, to read the reports prefix.
Answers
AA. An IAM instance profile that gives the instance a role, so the SDK gets short-lived credentials from the instance metadata service.
BB. An IAM user for the application, with its access key ID and secret saved in a configuration file on the instance.
CC. An AWS Secrets Manager secret that the worker role can read, with rotation turned on for the secret.
DD. A bucket policy statement that names the worker role as the only principal allowed to read the reports prefix.
EE. AWS Systems Manager Session Manager, with an IAM policy that allows sessions only to tagged instances and logs every session.
Show the answer and explanation
Correct matches
The worker code must read objects from the job bucket, with no credential stored on the instance or in its code.: A. An IAM instance profile that gives the instance a role, so the SDK gets short-lived credentials from the instance metadata service.
The worker must read a database password that rotates every 30 days, without a code change.: C. An AWS Secrets Manager secret that the worker role can read, with rotation turned on for the secret.
The administrators need an audited shell on a worker, without an inbound SSH port or a shared key.: E. AWS Systems Manager Session Manager, with an IAM policy that allows sessions only to tagged instances and logs every session.
The bucket owner must allow only the worker role, and no other role, to read the reports prefix.: D. A bucket policy statement that names the worker role as the only principal allowed to read the reports prefix.
About each answer
A. An instance profile gives the workers temporary credentials that rotate on their own, with nothing stored on the instance. It matches the need to read the job bucket without a stored credential.
B. This stores a long-term key on every instance, which the engineers forbid. No requirement uses it, because the instance profile does the job without a stored key.
C. Secrets Manager rotates the database password on a schedule, and the worker reads the current value at run time. The code does not change when the password rotates.
D. A bucket policy lets the bucket owner grant read access to one named role, and no other role receives it. It matches the reports-prefix requirement.
E. Session Manager opens shell sessions through the SSM Agent, so no inbound SSH port is needed. The logged sessions give the audit trail that the administrators must have.
Explanation
Instance profiles give code short-lived credentials, and Secrets Manager rotates a secret without a code change. Session Manager gives audited shell access without an inbound port, and a bucket policy limits reads to one role. A stored IAM user key is the one option that conflicts with the requirements.
Want more on Instance profiles, service roles and execution roles? The 5 full-length practice sets have 5 more Instance profiles, service roles and execution roles questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →