SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use an EC2 instance profile and attach it to the on-premises server.

  Why it's wrong here

  An instance profile is an IAM container that is only resolvable through the EC2 instance metadata service (IMDS), which is available exclusively inside EC2. Since an on-premises server has no access to the IMDS endpoint, it cannot retrieve the temporary credentials associated with the instance role. Even if you attempted to copy the role's credentials off an EC2 instance, that would violate the design intent and create a security risk. Thus, instance profiles cannot be used to provide temporary AWS credentials to workloads running outside AWS.

• ✗

  Configure a SAML 2.0 identity provider and federate the application.

  Why it's wrong here

  SAML 2.0 federation is designed for human-centric single sign-on, not for automated application or workload access. The SAML authentication flow requires an interactive browser and an identity provider that validates a user's credentials, after which it issues a SAML assertion that can be exchanged for temporary AWS credentials. An application running on a server cannot simply 'log in' via SAML without a user identity and an IdP session, making this approach inappropriate for non-human entities. Additionally, setting up a SAML IdP for an application introduces unnecessary complexity and does not directly grant temporary credentials for machine-to-machine access.

• ✗

  Create an IAM user with programmatic access and share the access key.

  Why it's wrong here

  Creating an IAM user with programmatic access yields long-term static access keys that do not expire, directly contradicting the requirement to provide temporary credentials. These keys remain valid indefinitely until manually rotated, creating a significant security burden and exposure risk if leaked. Sharing the access key among multiple systems or developers further amplifies the risk and violates best practices for least privilege and credential hygiene. IAM Roles Anywhere exists precisely to avoid long-lived keys by issuing short-lived, automatically expiring credentials for on-premises workloads.

• ✓

  Use IAM Roles Anywhere with a certificate authority to issue temporary credentials.

  Why this is correct

  IAM Roles Anywhere enables on-premises applications to safely obtain temporary AWS credentials by presenting an X.509 certificate issued by a trusted certificate authority (CA). The service uses the certificate's subject and issuer information to match the workload to an IAM role, then calls AWS STS to return temporary credentials that automatically expire after a configurable duration. This approach eliminates the need for long-term access keys and is the recommended pattern for non-AWS servers or hybrid workloads. It is the only option listed that directly satisfies the company's need for temporary credentials for an on-premises application.

Go deeper

Related to this question