DVA-C02 IAM Role Practice Question
A company runs an application on Amazon EC2 instances that need to read files from an Amazon S3 bucket. The developer must grant access to the S3 bucket without storing long-term credentials on the instances. Which approach should the developer use?
⚠ Common exam trap
Candidates often think storing credentials in environment variables or Secrets Manager is acceptable, but the question explicitly requires no long-term credentials on the instance, making the IAM role the only correct answer that leverages temporary credentials via the instance metadata service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with permissions to the S3 bucket and attach it to the EC2 instance profile.
Using an IAM role attached to an EC2 instance profile allows the application to obtain temporary security credentials from the AWS Security Token Service (STS) via the instance metadata service. This eliminates the need to store long-term credentials on the instance, adhering to the principle of least privilege and improving security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the access key ID and secret access key in environment variables on the EC2 instance.
Why it's wrong here
Environment variables holding an access key ID and secret access key are long-term credentials stored on the instance, directly violating the no-stored-credentials requirement. It is tempting because it avoids hard-coding keys in source, yet an attached IAM instance profile issuing temporary credentials is the mechanism required.
- ✓
Create an IAM role with permissions to the S3 bucket and attach it to the EC2 instance profile.
Why this is correct
Attaching an IAM role to the EC2 instance profile lets the instance obtain temporary credentials automatically from the instance metadata service, which rotate regularly. This satisfies the stem's constraint of granting S3 read access without storing long-term credentials on the instances, unlike embedding access keys.
- ✗
Use an S3 bucket policy that grants access to the EC2 instance's public IP address.
Why it's wrong here
S3 bucket policies evaluate IAM principals, not EC2 public IP addresses, so no identity is authenticated and the request is denied. It is tempting as a network-scoping idea, but an IAM role attached via an instance profile is what supplies temporary credentials without stored secrets.
- ✗
Store the credentials in AWS Secrets Manager and have the application retrieve them at startup.
Why it's wrong here
Storing credentials in AWS Secrets Manager still requires the application to retrieve a long-term access key and secret key at startup, which violates the requirement to avoid storing long-term credentials on the instances. This approach is tempting because Secrets Manager is designed for securely rotating and managing secrets, and would be correct if the application needed to authenticate to an external service with a static API key rather than assume an IAM role for S3 access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.