DVA-C02 Security Practice Question
A developer needs to allow an EC2 instance to read objects from a specific S3 bucket. Which is the MOST secure way to grant permissions?
⚠ Common exam trap
DVA-C02 often tests the misconception that security groups or bucket policies based on IP can grant S3 access — candidates pick those because they sound like network-level controls, but IAM roles with instance profiles are the only secure, credential-free method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with S3 read permission and attach it to the EC2 instance as an instance profile
Creating an IAM role with S3 read permission and attaching it to the EC2 instance as an instance profile is the most secure way because it provides temporary, automatically rotated credentials to the instance without storing any long-term secrets. The instance profile delivers credentials via the EC2 instance metadata service (IMDS), and the role's policy can be scoped to only the specific S3 bucket and read actions needed. This eliminates the risk of leaked access keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store AWS access keys in the EC2 instance's user data
Why it's wrong here
Storing AWS access keys directly within an EC2 instance's user data or on the instance itself is a severe security vulnerability. These static credentials could be compromised if the instance is breached, leading to unauthorized access to AWS resources. Furthermore, this method lacks automatic rotation and secure distribution, making credential management cumbersome and prone to errors, directly violating AWS security best practices for credential handling.
- ✗
Use an S3 bucket policy that allows access from the EC2 instance's public IP
Why it's wrong here
While S3 bucket policies can control access based on network conditions like source IP addresses, relying on an EC2 instance's public IP for access control is generally ineffective and insecure. EC2 instances often have dynamic public IPs, which can change upon stop/start, breaking the policy. More critically, S3 API calls originate from AWS service endpoints, not necessarily the instance's public IP, and this method does not provide identity-based authorization, which is crucial for secure access.
- ✓
Create an IAM role with S3 read permission and attach it to the EC2 instance as an instance profile
Why this is correct
This is the secure and recommended method. An IAM role, configured with a trust policy allowing the EC2 service to assume it, grants temporary, frequently rotated credentials to the EC2 instance. By attaching this role via an instance profile, the EC2 instance can make API calls to S3 using these temporary credentials, inheriting the S3 read permissions defined in the role's policy without ever storing static access keys on the instance. This approach adheres to the principle of least privilege and enhances security significantly.
- ✗
Attach a security group to the EC2 instance that allows S3 access
Why it's wrong here
Security groups function as virtual firewalls for EC2 instances, controlling inbound and outbound network traffic at the instance level. They operate at the network layer, permitting or denying TCP/UDP ports and IP ranges. However, security groups do not provide authorization for AWS API calls, including S3 operations. Access to S3 is controlled by IAM policies and bucket policies, which govern who can perform specific actions on resources, not by network connectivity rules.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.