SOA-C02 Security and Compliance Practice Question
A SysOps administrator needs to grant an application running on an Amazon EC2 instance access to an Amazon S3 bucket without embedding long-term AWS credentials in the application code. The EC2 instance is in a private subnet and must not use an IAM user access key. Which solution should the administrator use?
⚠ Common exam trap
The trap here is assuming that storing credentials in Parameter Store or an encrypted S3 bucket solves the problem, but those still involve long-term credentials and additional bootstrap challenges.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM role to the EC2 instance with a policy that allows the required S3 actions, and let the application use the instance metadata service to obtain temporary credentials.
Attaching an IAM role to the EC2 instance allows the application to obtain temporary credentials from the instance metadata service. This eliminates the need for long-term access keys and follows AWS best practices for least privilege and credential management. The role can be scoped to only the required S3 actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the AWS credentials in an encrypted Amazon S3 bucket and have the application download them at startup.
Why it's wrong here
This still relies on long-term credentials and introduces a bootstrap problem: the application needs credentials to access the bucket containing the credentials. It also increases the risk of credential leakage. The requirement is to avoid long-term credentials entirely, so this approach is not acceptable. It also adds unnecessary complexity compared to using an IAM role.
- ✗
Create an IAM user with programmatic access, generate an access key, and store it in AWS Systems Manager Parameter Store as a SecureString parameter.
Why it's wrong here
This approach still uses long-term credentials (an IAM user access key) and requires the application to retrieve and use them. The requirement explicitly states that long-term credentials must not be embedded or used. While Parameter Store can secure the key, it does not eliminate the need for an access key, and rotating it manually adds operational overhead. This does not meet the goal of avoiding long-term credentials.
- ✗
Configure the S3 bucket policy to allow access from the EC2 instance's private IP address using the aws:SourceIp condition.
Why it's wrong here
Using aws:SourceIp with a private IP address is ineffective for controlling access to S3 because S3 requests originate from the instance's public IP or NAT gateway, not the private IP. Moreover, this does not provide credentials to the application; it only restricts based on IP. The application would still need some form of authentication, and IP-based restrictions alone are not a secure or scalable solution for granting access.
- ✓
Attach an IAM role to the EC2 instance with a policy that allows the required S3 actions, and let the application use the instance metadata service to obtain temporary credentials.
Why this is correct
Attaching an IAM role to an EC2 instance provides temporary credentials through the instance metadata service (IMDS). The application can retrieve these credentials automatically without embedding long-term keys. This is the recommended best practice for granting AWS permissions to EC2 instances. The role's policy can be scoped to only the necessary S3 actions, following least privilege.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.