AWS Certified Developer Associate DVA-C02 Practice Question
A developer needs to enable an application hosted on Elastic Compute Cloud (EC2) instances to retrieve objects from a storage service that is managed under a separate organizational unit. What measure should be implemented to securely grant the necessary access without storing long-term credentials within the application’s codebase?
Embed a generated access and secret key of an IAM user with the necessary permissions into the application's environment variables for resource interaction.
Establish a cross-account IAM role with the required permissions to interact with the storage service and configure the EC2 instances to assume this role when accessing the resources.
Modify the access control configuration on the storage buckets to include the application host instances as explicit grantees for object retrieval.
Assign an Inline policy directly to the storage bucket that permits access to the EC2 instances based on their security group IDs.
The correct way to grant an application hosted on EC2 instances access to resources in another account without embedding static credentials is by having the application assume an IAM role that has the necessary permissions to access the storage service, and establishing trust between the accounts. The role's trust policy will allow EC2 instances from the application host's account to assume it. This practice aligns with AWS security best practices by avoiding static credential storage within the application and ensuring the principle of least privilege. Directly attaching IAM policies to the resources or using ACLs does not address the requirement for cross-account access. IAM users with static credentials should be avoided as it contradicts best practices of using dynamic, short-lived credentials provided by IAM roles.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is an IAM role and how does it work in AWS?
Open an interactive chat with Bash
What does the principle of least privilege mean in the context of IAM roles?
Open an interactive chat with Bash
What are the advantages of using temporary credentials over static credentials?
Open an interactive chat with Bash
AWS Certified Developer Associate DVA-C02
Security
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access