DVA-C02 Development with AWS Services Practice Question
A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon S3 bucket. The company wants to follow the principle of least privilege. How should the developer provide the necessary permissions?
⚠ Common exam trap
Many candidates confuse instance profiles (used with EC2 launch type) with task roles (used with Fargate), leading them to select Option B, but Fargate tasks cannot assume an instance profile because there is no underlying EC2 instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM task role with S3 permissions and associate it with the ECS task definition.
Amazon ECS with Fargate launch type uses IAM task roles to grant permissions to containers at the task level. The task role is an IAM role that the ECS task assumes, allowing the application to securely access S3 without hardcoding credentials. This follows the principle of least privilege by scoping permissions to the specific task and using temporary credentials via the AWS STS service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon EFS to store access keys.
Why it's wrong here
Using Amazon EFS to store access keys is an insecure and inappropriate method for managing AWS credentials. EFS is a network file system designed for shared file storage, not a secure credential vault. It lacks native integration with AWS IAM for fine-grained access control to specific secrets, relying instead on network security groups and POSIX file permissions, which are insufficient for protecting sensitive access keys from unauthorized application access or accidental exposure.
- ✗
Assign an IAM instance profile to the Fargate tasks.
Why it's wrong here
Assigning an IAM instance profile to Fargate tasks is incorrect because Fargate is a serverless compute engine where AWS manages the underlying infrastructure. There are no EC2 instances for users to provision or directly manage, thus instance profiles, which are designed to grant permissions to EC2 instances, are not applicable. Fargate tasks require an IAM task role to grant permissions directly to the containerized application itself, not to an underlying host.
- ✓
Create an IAM task role with S3 permissions and associate it with the ECS task definition.
Why this is correct
Creating an IAM task role with S3 permissions and associating it with the ECS task definition is the recommended and most secure approach. This method grants temporary, specific permissions directly to the containers within an ECS task, allowing them to interact with AWS services like S3 without embedding static credentials. It adheres to the principle of least privilege, ensuring the application only has the necessary permissions and that credentials are automatically managed and rotated by AWS.
- ✗
Store AWS credentials in the container image.
Why it's wrong here
Storing AWS credentials directly within the container image is a significant security risk and a highly discouraged practice. These static credentials become embedded and distributed with every copy of the image, making them extremely difficult to rotate, revoke, and prone to compromise if the image registry or any deployed container is breached. This approach violates fundamental security principles by exposing sensitive information and creating a wide attack surface.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.