SCS-C02 Identity and Access Management Practice Question
A company uses IAM roles for EC2 instances. An application running on an EC2 instance needs to read from an S3 bucket in another AWS account. What is the most secure way to grant access?
⚠ Common exam trap
SCS-C02 often tests whether candidates choose temporary role-based credentials over long-term access keys or public access, tempting them with seemingly simple solutions (public bucket, IP allowlist) that violate least privilege and security best practices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in the target account with read access to the bucket, and allow the EC2 instance's role to assume it.
The most secure cross-account access pattern is to create an IAM role in the target (bucket-owning) account with read access to the S3 bucket, and allow the EC2 instance's role in the source account to assume it via STS AssumeRole. This uses temporary credentials, avoids long-term keys, and follows least privilege without exposing the bucket publicly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role in the target account with read access to the bucket, and allow the EC2 instance's role to assume it.
Why this is correct
By creating an IAM role in the target account with read-only permissions to the S3 bucket, the application can use the EC2 instance's existing instance profile role to assume that role via STS AssumeRole. The target account role's trust policy must explicitly allow the EC2 instance role as a principal, and the instance role needs sts:AssumeRole permission. This yields temporary security credentials, avoids storing long-term keys, and adheres to least-privilege cross-account access.
- ✗
Store the other account's IAM user access keys in the EC2 instance.
Why it's wrong here
Embedding the other account's IAM user access keys on the EC2 instance introduces long-term static credentials that can be accidentally committed to source control, leaked through logs, or extracted from compromised instances. IAM users' keys do not automatically rotate, and managing them across instances is error-prone; AWS recommends AWS Identity and Access Management roles with temporary credentials for any workload on EC2, especially for cross-account scenarios. These credentials also grant permissions directly tied to the IAM user, bypassing the instance role and making audit and least-privilege enforcement difficult.
- ✗
Make the bucket public.
Why it's wrong here
Making the S3 bucket public stops relying on any identity or authentication, allowing any unauthenticated user on the internet to read (or potentially modify, if write is enabled) the objects and thus violating confidentiality. Public access does not scope the permission to the application's EC2 instance; it broadens the attack surface, and AWS's public access block settings would discourage or prevent such a configuration. This approach has no way to grant read-only access specifically to the EC2 instance without exposing data to everyone.
- ✗
Create a bucket policy that allows access from the EC2 instance's public IP.
Why it's wrong here
Using a bucket policy condition based on the EC2 instance's public IP address treats a network address as an access credential, but public IPs can change when an instance is stopped/started, and Elastic IPs can be reassigned; moreover, multiple clients or other AWS customers can reside behind the same public IP (e.g., NAT gateway), so the condition is coarse and unreliable. A policy conditioned on aws:SourceIp does not verify the caller is a specific IAM principal, so it will accept any client that happens to originate from that IP space. Cross-account access should be granted based on an IAM principal identity and temporary credentials, not ephemeral network attributes.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.