AWS Certified SysOps Administrator SOA-C01 – Question493

A user has created an application which will be hosted on EC2. The application makes API calls to DynamoDB to fetch certain data. The application running on this instance is using the SDK for making these calls to DynamoDB. Which of the below mentioned statements is true with respect to the best practice for security in this scenario?

A. The user should create an IAM user with permissions to access DynamoDB and use its creden-tials within the application for connecting to DynamoDB
B. The user should create an IAM user with DynamoDB and EC2 permissions. Attach the user with the application so that it does not use the root account credentials
C. The user should attach an IAM role to the EC2 instance with necessary permissions for making API calls to DynamoDB.
D. The user should create an IAM role with EC2 permissions to deploy the application

Correct Answer: C

Explanation:

Explanation: With AWS IAM a user is creating an application which runs on an EC2 instance and makes requests to AWS, such as DynamoDB or S3 calls. Here it is recommended that the user should not create an IAM user and pass the user’s credentials to the application or embed those credentials inside the ap-plication. Instead, the user should use roles for EC2 and give that role access to DynamoDB /S3. When the roles are attached to EC2, it will give temporary security credentials to the application hosted on that EC2, to connect with DynamoDB / S3. Reference:
http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_WorkingWithGr…