DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an IAM user with programmatic access, store the access key and secret key in a configuration file on the EC2 instance.

  Why it's wrong here

  This approach is a significant security anti-pattern. Storing static IAM user access keys and secret keys directly on an EC2 instance creates a persistent attack vector; if the instance is compromised, these long-term credentials can be exfiltrated and used indefinitely until manually rotated or revoked. This method also lacks automatic credential rotation, increasing the operational burden and the window of vulnerability.

• ✗

  Store the DynamoDB credentials in AWS Systems Manager Parameter Store as a SecureString, and retrieve them from the EC2 instance at runtime.

  Why it's wrong here

  While AWS Systems Manager Parameter Store is excellent for secure configuration management, this solution introduces a circular dependency without solving the core problem. The EC2 instance would still require some form of credentials, likely an IAM user's access key or an IAM role, to authenticate and retrieve the DynamoDB credentials from Parameter Store. This means long-term credentials would still be present on the instance, just shifted from DynamoDB direct access to Parameter Store access, maintaining the same security risk.

• ✓

  Create an IAM role with the necessary DynamoDB permissions, and attach the role to the EC2 instance profile. The SDK will automatically retrieve temporary credentials from the instance metadata.

  Why this is correct

  This is the recommended and most secure method. By attaching an IAM role to the EC2 instance profile, the instance is granted temporary, frequently rotated credentials via the Instance Metadata Service (IMDS). AWS SDKs and CLIs automatically query IMDS for these credentials, eliminating the need to store any long-term access keys directly on the instance. This significantly reduces the attack surface and simplifies credential management.

• ✗

  Use a Lambda function to generate temporary credentials for the EC2 instance and pass them via user data at launch.

  Why it's wrong here

  This approach is overly complex and introduces new security vulnerabilities. While a Lambda function could generate temporary credentials, passing them via user data means they are stored unencrypted on the instance, accessible to anyone with sufficient permissions to view instance details. Furthermore, these temporary credentials would still need to be refreshed and managed manually by the application, which is precisely what IAM roles and the Instance Metadata Service are designed to automate securely.