Instance profiles, service roles and execution roles: SCS-C03 study notes and practice questions
What to know about Instance profiles, service roles and execution roles for the SCS-C03 exam, from the Infrastructure Security domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe an application that needs AWS access, such as reading a bucket or calling a table, and a team tempted to put access keys in code or in an environment variable. You pick the role type that attaches permissions to the compute resource and rotates its credentials automatically.
Roles for compute
An EC2 instance receives its role through an instance profile, a container that holds one role. The console creates a profile with the same name when you pick a role. The instance then gets short-lived credentials from the instance metadata service.
Require IMDSv2 on every instance. Without it, a server-side request forgery bug can expose credentials through the metadata endpoint. Set the hop limit to 1 unless a container genuinely needs more.
Amazon ECS separates the task role, which the application uses for its own AWS calls, from the task execution role, which the ECS agent uses to pull images from ECR and send logs to CloudWatch Logs.
Amazon EKS Pod Identity associates an IAM role with a Kubernetes service account, so each pod gets credentials for its own role. It is the newer alternative to IAM roles for service accounts (IRSA). Read the Pod Identity guide for the association model.
Lambda uses an execution role for the permissions the function needs and for writing its logs.
A service role is assumed by an AWS service on your behalf, such as CloudFormation or CodeBuild. Scope it tightly, because the service acts with its permissions.
iam:PassRole lets a user attach a role to a resource. Name the allowed roles in the policy, and add a condition on iam:PassedToService. Without that, a user who can create a Lambda function can pass an administrator role to it.
A trust policy names the principal that may assume the role. A role for EC2 trusts ec2.amazonaws.com.
How to choose
Scenario wording
Pick
EC2 application needs S3 access with no keys
Instance profile with a least-privilege role, and IMDSv2 required
ECS container calls DynamoDB
Task role. The execution role only pulls images and writes logs
Pods in one cluster need different permissions
EKS Pod Identity association per service account
Function reads one secret
Lambda execution role scoped to that secret
CloudFormation creates resources for a team
CloudFormation service role
A user must hand a role to a service
iam:PassRole limited to named roles
Common traps
Access keys in environment variables or configuration files.
Granting the application permissions on the execution role. The ECS agent gets those permissions, not the app.
Leaving IMDSv1 enabled when the requirement is protection against credential theft.
Broad iam:PassRole with a resource of *, which is a common privilege-escalation path.
Mixing up the instance profile and the role. The role holds the permissions; the profile is how EC2 attaches it.
A payments startup runs a fleet of worker instances on Amazon EC2. The workers read files from Amazon S3 and call a database. The engineers want no long-term access key stored on any instance, and the security team wants administrators to reach the instances without any inbound SSH port.
Match each requirement to the access method that meets it. Each option is used at most once, and one option is not needed.
Match each item to one answer. An answer can be used more than once, and some may not be used.
Items
The worker code must read objects from the job bucket, with no credential stored on the instance or in its code.
The worker must read a database password that rotates every 30 days, without a code change.
The administrators need an audited shell on a worker, without an inbound SSH port or a shared key.
The bucket owner must allow only the worker role, and no other role, to read the reports prefix.
Answers
AA. An IAM instance profile that gives the instance a role, so the SDK gets short-lived credentials from the instance metadata service.
BB. An IAM user for the application, with its access key ID and secret saved in a configuration file on the instance.
CC. An AWS Secrets Manager secret that the worker role can read, with rotation turned on for the secret.
DD. A bucket policy statement that names the worker role as the only principal allowed to read the reports prefix.
EE. AWS Systems Manager Session Manager, with an IAM policy that allows sessions only to tagged instances and logs every session.
Show the answer and explanation
Correct matches
The worker code must read objects from the job bucket, with no credential stored on the instance or in its code.: A. An IAM instance profile that gives the instance a role, so the SDK gets short-lived credentials from the instance metadata service.
The worker must read a database password that rotates every 30 days, without a code change.: C. An AWS Secrets Manager secret that the worker role can read, with rotation turned on for the secret.
The administrators need an audited shell on a worker, without an inbound SSH port or a shared key.: E. AWS Systems Manager Session Manager, with an IAM policy that allows sessions only to tagged instances and logs every session.
The bucket owner must allow only the worker role, and no other role, to read the reports prefix.: D. A bucket policy statement that names the worker role as the only principal allowed to read the reports prefix.
About each answer
A. An instance profile gives the workers temporary credentials that rotate on their own, with nothing stored on the instance. It matches the need to read the job bucket without a stored credential.
B. This stores a long-term key on every instance, which the engineers forbid. No requirement uses it, because the instance profile does the job without a stored key.
C. Secrets Manager rotates the database password on a schedule, and the worker reads the current value at run time. The code does not change when the password rotates.
D. A bucket policy lets the bucket owner grant read access to one named role, and no other role receives it. It matches the reports-prefix requirement.
E. Session Manager opens shell sessions through the SSM Agent, so no inbound SSH port is needed. The logged sessions give the audit trail that the administrators must have.
Explanation
Instance profiles give code short-lived credentials, and Secrets Manager rotates a secret without a code change. Session Manager gives audited shell access without an inbound port, and a bucket policy limits reads to one role. A stored IAM user key is the one option that conflicts with the requirements.
Want more on Instance profiles, service roles and execution roles? The 5 full-length practice sets have 5 more Instance profiles, service roles and execution roles questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Instance profiles, service roles and execution roles