CLF-C02 Security and Compliance Practice Question
A company needs to grant an EC2 instance permission to write to an S3 bucket. What is the most secure way to accomplish this?
⚠ Common exam trap
Many exam-takers think storing credentials in environment variables is secure because they are not in code, but AWS explicitly recommends IAM roles over any form of long-term access key storage for EC2 instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM role with the appropriate S3 permissions to the EC2 instance
Attaching an IAM role to an EC2 instance allows the instance to securely obtain temporary credentials via the instance metadata service (IMDS). These credentials are automatically rotated by AWS, eliminating the need to hardcode or store long-term access keys. The role's policy grants only the necessary S3 write permissions, following the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the IAM user access keys in the application code
Why it's wrong here
Hardcoding IAM user access keys in application code is a severe security risk because the keys become embedded in source files, build artifacts, and version-control history. Any source-code leak, shared repository, or decompiled artifact exposes the long-term credentials, and they remain valid until manually revoked. Since these keys are long-lived, rotating them requires editing and redeploying the application, creating downtime and operational burden.
- ✗
Store IAM access keys in environment variables on the EC2 instance
Why it's wrong here
Storing IAM access keys as environment variables on the EC2 instance only moves the plaintext credentials from source code to runtime memory. Any process able to inspect the environment, such as through /proc/self/environ, process listings, debugging tools, or a compromised container, can capture them. Additionally, the keys are long-term, so they do not rotate automatically and remain at risk in AMI snapshots or user-data scripts.
- ✓
Attach an IAM role with the appropriate S3 permissions to the EC2 instance
Why this is correct
Attaching an IAM role to the EC2 instance is the AWS-recommended approach because the instance obtains temporary, automatically rotated credentials from the instance metadata service. The AWS SDK automatically retrieves these credentials, so no long-term access keys are written to code, configuration files, or environment variables. This enforces least-privilege permissions via the role policy and eliminates manual credential rotation or management.
- ✗
Create an IAM user and configure the instance with its credentials
Why it's wrong here
Creating a dedicated IAM user and installing its access keys on the instance introduces long-term static credentials that require manual rotation whenever they are exposed or for compliance. These keys are stored in files on the instance or in configuration, making them targets for exfiltration via local exploits or backups. If multiple instances share the IAM user, privilege separation is lost, and auditing individual workloads becomes difficult.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.