SOA-C03 · Question #97
An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A CloudOps engineer must ensure that the application can read write, and delete messages…
The correct answer is D. Create and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM. The most secure approach is to use an IAM role for EC2 (no long-lived credentials) and grant only the specific SQS actions needed (send, receive, delete) on the required queues. The instance automatically receives temporary credentials via the role, enforcing least privilege…
Question
An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A CloudOps engineer must ensure that the application can read write, and delete messages from the SQS queues. Which solution will meet these requirements in the MOST secure manner?
Options
- ACreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the
- BCreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the
- CCreate and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM
- DCreate and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM
How the community answered
(32 responses)- A3% (1)
- B9% (3)
- C3% (1)
- D84% (27)
Explanation
The most secure approach is to use an IAM role for EC2 (no long-lived credentials) and grant only the specific SQS actions needed (send, receive, delete) on the required queues. The instance automatically receives temporary credentials via the role, enforcing least privilege and avoiding hard-coded or environment-stored access keys.
Topics
Community Discussion
No community discussion yet for this question.