DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  IAM group

  Why it's wrong here

  An IAM group is a collection of IAM users, designed to simplify permission management for multiple human users or service accounts. Policies attached to a group grant permissions to all users within that group. However, an EC2 instance is not an IAM user and cannot be a member of an IAM group, nor can an IAM group be directly associated with an EC2 instance to grant it permissions. Therefore, this option is unsuitable for granting an EC2 instance access to DynamoDB.

• ✓

  IAM role

  Why this is correct

  An IAM role is an identity that can assume permissions, designed for AWS services, federated users, or EC2 instances. When an IAM role is attached to an EC2 instance via an instance profile, the instance can assume the role, obtaining temporary security credentials that grant it the permissions defined in the role's policies. This mechanism allows the EC2 instance to securely access other AWS services like DynamoDB without storing long-term credentials on the instance itself, adhering to the principle of least privilege and enhancing security.

• ✗

  IAM user

  Why it's wrong here

  An IAM user represents a person or service that interacts with AWS, typically associated with long-term credentials such as access keys and secret access keys. Storing these long-term credentials directly on an EC2 instance creates a significant security risk, as a compromise of the instance would expose these static credentials. While technically possible to configure an EC2 instance to use an IAM user's credentials, it is a poor security practice and violates the principle of using temporary, rotating credentials for compute resources.

• ✗

  Resource-based policy on the DynamoDB table

  Why it's wrong here

  A resource-based policy is attached directly to an AWS resource, such as an S3 bucket or KMS key, to specify who can access that resource and under what conditions. While DynamoDB does support resource-based policies for certain features like DynamoDB Streams with Kinesis Data Streams, it does not natively support direct resource-based policies for granting an EC2 instance access for standard table operations. The primary and recommended mechanism for an EC2 instance to gain permissions within its own account is through an IAM role, not by being explicitly listed in a resource's policy.

Go deeper

Related to this question