A company runs a data analytics application on an Amazon EC2 instance. The application needs to read CSV files from an Amazon S3 bucket to process them. The security team requires that no long-term AWS credentials (access key ID and secret access key) be stored on the instance. The instance is already launched in a private subnet within a VPC. Which solution meets the security requirement and provides the necessary access?

Store the AWS access key ID and secret access key in a configuration file on the instance's local disk.

This option directly violates the security requirement by storing long-term credentials permanently on the instance. If the instance is compromised, the static credentials can be stolen and used by an attacker.

Write a resource-based policy on the S3 bucket that allows access based on the private IP address of the EC2 instance.

S3 bucket policies can use the aws:SourceIp condition, but that condition expects public IP addresses, not private IPs. Since the instance is in a private subnet without a public IP, this policy would not grant access. Additionally, IP-based authorization alone is not a secure replacement for IAM credentials.

Create a new IAM user with the required permissions. Store the IAM user's access key and secret key in AWS Systems Manager Parameter Store, and configure the application to retrieve them at runtime.

Although this method separates credentials from the code, it still uses long-term IAM user access keys. These are static secrets that can be leaked if Parameter Store access is compromised. The IAM role approach is more secure because it uses temporary credentials that are automatically rotated.

What does this CLF-C02 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create an IAM role with the required S3 read permissions. Attach the role to the EC2 instance profile. — The most secure AWS best practice for granting an EC2 instance access to AWS services (like S3) is to use an IAM role. The role is attached to the EC2 instance via an instance profile. The AWS SDK or CLI running on the instance automatically retrieves temporary credentials from the instance metadata service (IMDS). These credentials are rotated automatically and never stored persistently on the instance. This approach eliminates the need to manage long-term access keys on the instance, fully satisfying the security team's mandate.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.