SCS-C02 Identity and Access Management Practice Question
A developer needs to grant an EC2 instance read-only access to an S3 bucket. Which of the following is the most secure way to provide these permissions?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with read-only access and attach it to the EC2 instance profile.
Using an IAM role attached to an instance profile grants temporary credentials and eliminates long-term access keys. Option A is incorrect because storing credentials in Parameter Store (or any static storage) is less secure than using an instance profile, and IAM roles do not have static credentials to store. Option C is incorrect because a bucket policy cannot grant access based on an instance's public IP in a secure or reliable way, and it would grant access to anyone with that IP, not just the instance. Option D is incorrect because storing IAM user access keys in user data exposes long-term credentials, which is less secure than using an instance profile.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an IAM role and store the credentials in AWS Systems Manager Parameter Store, then retrieve them at instance launch.
Why it's wrong here
Retrieving static IAM user credentials from Parameter Store still creates long-lived access keys that must be rotated and can leak. Parameter Store is for configuration secrets, not for granting AWS service permissions; instance profiles supply temporary credentials automatically.
- ✓
Create an IAM role with read-only access and attach it to the EC2 instance profile.
Why this is correct
An IAM role attached to the instance profile supplies temporary, automatically rotated credentials to the EC2 instance, avoiding long-term access keys on the instance. This satisfies the requirement for read-only S3 access using the most secure mechanism.
- ✗
Create a bucket policy that grants read-only access to the instance's public IP address.
Why it's wrong here
S3 bucket policies cannot condition on an EC2 instance's public IP, which changes on stop/start and is shared by NAT gateways, so access is neither stable nor instance-specific. IP-based conditions suit fixed corporate egress ranges, not dynamic compute.
- ✗
Create an IAM user with read-only access and store the access keys in the instance's user data.
Why it's wrong here
Embedding IAM user access keys in user data exposes long-lived credentials in instance metadata and console output, and they cannot be scoped to the instance. This pattern suits local development workstations, never production EC2 workloads.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.