DOP-C02 · Question #240
A company wants to deploy a workload on several hundred Amazon EC2 instances. The company will provision the EC2 instances in an Auto Scaling group by using a launch template. The workload will pull…
The correct answer is A. Create an IAM role that has the appropriate permissions for S3 buckets Add the IAM role to an B. Update the launch template to include the IAM instance profile. Explanation Attaching an IAM role to EC2 instances (via an instance profile) is the AWS-recommended approach for granting permissions because IAM roles automatically provide temporary, rotating security credentials through the EC2 instance metadata service - perfectly…
Question
A company wants to deploy a workload on several hundred Amazon EC2 instances. The company will provision the EC2 instances in an Auto Scaling group by using a launch template. The workload will pull files from an Amazon S3 bucket, process the data, and put the results into a different S3 bucket. The EC2 instances must have least-privilege permissions and must use temporary security credentials. Which combination of steps will meet these requirements? (Choose two.)
Options
- ACreate an IAM role that has the appropriate permissions for S3 buckets Add the IAM role to an
- BUpdate the launch template to include the IAM instance profile.
- CCreate an IAM user that has the appropriate permissions for Amazon S3 Generate a secret key
- DCreate a trust anchor and profile Attach the IAM role to the profile.
- EUpdate the launch template Modify the user data to use the new secret key and token.
How the community answered
(28 responses)- A82% (23)
- C11% (3)
- D4% (1)
- E4% (1)
Explanation
Explanation
Attaching an IAM role to EC2 instances (via an instance profile) is the AWS-recommended approach for granting permissions because IAM roles automatically provide temporary, rotating security credentials through the EC2 instance metadata service - perfectly satisfying the least-privilege and temporary credentials requirements. Option A creates the role with the correct S3 permissions, and Option B wires it into the launch template via the instance profile, ensuring every Auto Scaling instance automatically inherits the role.
Why the distractors fail:
- Option C creates an IAM user with a static secret key - these are long-term credentials, directly violating the temporary credentials requirement.
- Option D describes IAM Roles Anywhere (trust anchors/profiles), which is designed for on-premises workloads, not EC2 instances that already have a native role mechanism.
- Option E embedding secret keys in user data is a serious security anti-pattern - credentials would be exposed in plaintext and are still long-term, not temporary.
Memory Tip
Remember: "EC2 + S3 access = IAM Role + Instance Profile" - any time an exam question mentions EC2 needing AWS service access with temporary credentials, the answer will always involve an IAM role attached through a launch template's instance profile, never IAM users or static keys.
Topics
Community Discussion
No community discussion yet for this question.