SAA-C03 Design Secure Architectures Practice Question
A team is designing a new workload that runs on Amazon EC2 instances in a private subnet. The instances must read and write objects in an Amazon S3 bucket in the same account, and security policy forbids long-term access keys on the instances. The team wants to grant least-privilege access and ensure the instances can reach S3 without traversing the public internet. (Choose two.)
⚠ Common exam trap
The trap here is assuming that storing keys in Parameter Store SecureString makes them acceptable, when the policy forbids long-term access keys on the instances entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM role to the instances using an instance profile, and grant the role only the required s3:GetObject and s3:PutObject permissions on the specific bucket.
An IAM role attached through an instance profile supplies temporary credentials without long-term keys, and an S3 gateway endpoint keeps bucket traffic on the AWS network. Together they satisfy the credential, least-privilege, and private-connectivity requirements. Static keys in Parameter Store and NAT-based egress each violate one of the stated constraints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a NAT gateway in the public subnet and route the private subnet's default route to it so the instances can reach the S3 public endpoint.
Why it's wrong here
A NAT gateway allows outbound access to the internet, which means S3 traffic leaves the VPC and traverses public AWS endpoints. This contradicts the requirement to avoid the public internet, and it adds cost and an additional egress path. It also does not help with the credential requirement at all.
- ✗
Store an IAM user access key and secret access key in AWS Systems Manager Parameter Store as a SecureString, and have the application retrieve them at startup.
Why it's wrong here
Retrieving static IAM user credentials from Parameter Store still places long-term access keys in the workload, which the security policy explicitly forbids. It also grants the identity the full set of permissions attached to that IAM user rather than the narrow S3 actions needed, so both the credential and least-privilege requirements are violated.
- ✓
Attach an IAM role to the instances using an instance profile, and grant the role only the required s3:GetObject and s3:PutObject permissions on the specific bucket.
Why this is correct
An instance profile delivers temporary credentials through the instance metadata service, so no long-term access keys are stored on the instances. Scoping the role policy to the exact bucket and the two needed actions enforces least privilege. This directly addresses both the credential and the permission requirements for the workload.
- ✗
Configure an S3 bucket policy that allows the s3:GetObject and s3:PutObject actions for the account root user, and let the instances inherit those permissions.
Why it's wrong here
Granting access to the account root user does not give the EC2 instances any identity to assume, and using the root user for application access is a severe security anti-pattern. The instances still need an IAM role, and the bucket policy as described is far broader and more sensitive than the intended least-privilege grant.
- ✓
Create an S3 gateway endpoint and associate it with the private subnet's route table so that traffic to S3 uses the endpoint instead of the internet.
Why this is correct
A gateway endpoint for S3 provides private connectivity from the VPC to S3 by adding a prefix list route to the route table. Traffic to the bucket stays on the AWS network and never leaves through an internet gateway or NAT device, which satisfies the requirement that the instances reach S3 without traversing the public internet.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 935 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.