SAA-C03 practice question: IAM roles and policies (1 of 3)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics company runs a nightly invoicing application on Amazon EC2 instances in an Auto Scaling group. The application reads delivery records from one Amazon S3 bucket and writes finished invoices to a second bucket.
Other applications run in the same VPC and must not be able to use either bucket. The security team bans long-term access keys on instances and in code, and wants permissions kept to the minimum the application needs.
Which solution meets these requirements MOST securely?
Choose one answer.
AA. Create an IAM user with a policy for both buckets, store its access key in AWS Secrets Manager, and have the application fetch the key at startup.
BB. Attach an instance profile to the launch template with an IAM role that allows s3:GetObject on the source bucket and s3:PutObject on the invoice bucket.
CC. Attach an instance profile to the launch template with an IAM role that has the AWS managed AmazonS3FullAccess policy, so the application can reach both buckets.
DD. Create an S3 gateway endpoint, and add bucket policies that allow any principal whose requests arrive through that endpoint, so the instances need no credentials.
Show the answer and explanation
Answer: B
A. Wrong: Secrets Manager protects the key at rest, but an IAM user access key is still a long-term credential that the application holds in memory and that someone must rotate. The security team has banned long-term access keys. An IAM role delivered through an instance profile gives temporary credentials instead. Learn more: Security best practices in IAM (opens in a new tab)
C. Wrong: The role removes long-term keys, so half of the requirement is met. However, AmazonS3FullAccess grants every S3 action on every bucket in the account, far more than the application needs. AWS recommends replacing broad managed policies with a customer managed policy scoped to the task. Learn more: Security best practices in IAM (opens in a new tab)
D. Wrong: The aws:SourceVpce condition checks only the network path, not who is calling. Any workload in the VPC that routes through the endpoint would get the same access, which breaks the rule that other applications must not use the buckets. Identity-based access with an IAM role is needed. Learn more: Controlling access from VPC endpoints with bucket policies (opens in a new tab)
Explanation
An IAM role attached through an instance profile is the standard way to give an EC2 application AWS permissions without long-term keys: the credentials are temporary and rotate automatically. Scoping the role's policy to s3:GetObject on the source bucket and s3:PutObject on the invoice bucket keeps permissions to the minimum and keeps other workloads in the VPC out, which a network-only condition cannot do.
Want more on IAM roles and policies? The 5 full-length practice sets have 10 more IAM roles and policies questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →