SCS-C02 Identity and Access Management Practice Question
A developer needs to grant an EC2 instance access to an S3 bucket. Which is the most secure way to provide credentials to the EC2 instance?
⚠ Common exam trap
Many candidates think storing keys in S3 or environment variables is acceptable, but the exam emphasizes that any form of long-term static credential storage on an EC2 instance is insecure compared to using IAM roles with instance profiles and temporary credentials from STS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role and attach it to the EC2 instance profile
It uses an IAM role attached to an EC2 instance profile, which allows the instance to obtain temporary, automatically rotated credentials from the AWS STS service via the instance metadata service (IMDS). This eliminates the need to hardcode, store, or manage long-term access keys, significantly reducing the risk of credential exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store AWS access keys in the application code
Why it's wrong here
Hardcoding AWS access keys directly into application code embeds long-lived, static credentials in the source itself. This creates a severe security risk because keys can leak through version control history, code sharing, or build logs, and they never expire automatically. Any leaked key remains valid until manually revoked, giving an attacker persistent access to all resources the key is authorized for.
- ✗
Store the keys in an S3 bucket and download them at startup
Why it's wrong here
Storing the AWS access keys in an S3 bucket and downloading them at startup replaces the location problem but not the core issue: you are still relying on static, long-lived credentials. The S3 object needs its own separate IAM protection, encryption, and tightened bucket policies, which adds complexity and attack surface. If the bucket is misconfigured or the object's permissions are too broad, an attacker can retrieve the keys exactly as the instance does, and the credentials still lack automatic rotation.
- ✓
Create an IAM role and attach it to the EC2 instance profile
Why this is correct
Creating an IAM role and attaching it to the EC2 instance profile is the AWS-recommended pattern. The instance profile securely delivers temporary credentials to the instance through the instance metadata service (IMDSv2), and the AWS SDKs automatically retrieve and refresh these credentials. Permissions are scoped to the role's policy, no secrets are stored on disk or in source code, and credentials rotate automatically, minimizing the blast radius of any single credential leak.
- ✗
Use environment variables to store the keys
Why it's wrong here
Using environment variables to store AWS access keys exposes them to any process or user that can read the instance's environment, such as through /proc/<pid>/environ or debugging tools. Environment variables are also often captured by orchestration tools, logging frameworks, or crash reports, making inadvertent disclosure easy. Additionally, these remain static access keys with no automatic rotation, so they still require manual key management and revocation instead of leveraging the temporary credentials provided by an IAM instance profile.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.