SAA-C03 Practice Question 31: EC2 Instance Profile Credentials
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 4 · question 1 of 10
An application on EC2 instances in an Auto Scaling group reads objects from an S3 bucket. The deployment script writes an IAM user's access key ID and secret access key into a configuration file baked into the AMI. A security review demands that no long-lived credentials be stored on the instances, and the application code must not change the way it calls the AWS SDK.
What should the solutions architect do?
Show answer and explanation
Answer:
An instance profile delivers temporary credentials to the instance through the Instance Metadata Service. The AWS SDKs look there automatically as part of the default credential provider chain, so once the configuration file is removed the application picks up role credentials with no code change. The credentials are rotated by AWS before they expire and never exist as a stored secret on disk or in the AMI, which is what the review requires.
Option A still relies on a long-lived access key; it only moves it from the AMI into Secrets Manager, and the instance needs credentials to authenticate to Secrets Manager in the first place.
Option B leaves the same permanent key on the instance and adds an encryption step. Anything the application can decrypt at start-up, an attacker with access to the instance can decrypt too.
Option D shortens the life of the credential without removing it. A key written to disk every day is still a long-lived credential by the review's definition, and the rotation machinery is work that instance profiles do for free.
Reference: Use an IAM role to grant permissions to applications running on EC2 instances