A company runs an application on EC2 instances that need access to RDS credentials stored in AWS Secrets Manager. Which solution meets this requirement?

The correct answer is A. Create an IAM role, and attach the role to each EC2 instance profile. Use an identity-based policy. Option A uses an IAM role attached to the EC2 instance profile, enabling secure and automated access to Secrets Manager. This is the recommended approach. Option B uses IAM users, which is less secure and harder to manage. Option C is not practical for accessing secrets…

Submitted by joshua94· Mar 4, 2026Design Secure Architectures

Question

Options

ACreate an IAM role, and attach the role to each EC2 instance profile. Use an identity-based policy
BCreate an IAM user, and attach the user to each EC2 instance profile. Use a resource-based
CCreate a resource-based policy for the secret. Use EC2 Instance Connect to access the secret.
DCreate an identity-based policy for the secret. Grant direct access to the EC2 instances.

How the community answered

(29 responses)

A
93% (27)
C
3% (1)
D
3% (1)

Explanation

Option A uses an IAM role attached to the EC2 instance profile, enabling secure and automated access to Secrets Manager. This is the recommended approach. Option B uses IAM users, which is less secure and harder to manage. Option C is not practical for accessing secrets programmatically. Option D violates best practices by granting direct access to the EC2 instance.

Community Discussion

No community discussion yet for this question.

Full SAA-C03 Practice