Question

A developer builds a Java application that runs on an EC2 instance and needs to read objects from an Amazon S3 bucket. During development, the code used long-term IAM user access keys stored in a properties file. Before deploying to production, the developer must eliminate the hardcoded credentials while granting the application least-privilege S3 read access. What is the recommended approach?

Accepted Answer

Attach an IAM role with an S3 read-only policy to the EC2 instance via an instance profile, and let the AWS SDK retrieve temporary credentials automatically.

Answer

Store the IAM user access keys in AWS Secrets Manager and have the application fetch them at startup using the Secrets Manager SDK.

Answer

Encrypt the properties file containing the access keys with a KMS customer managed key and decrypt it at runtime.

Answer

Set the access key ID and secret access key as EC2 user data so they are injected into the environment at boot time.