Question

A developer is building an application running on an EC2 instance in Account A. The application must read objects from an S3 bucket owned by Account B. The security team requires that no long-term credentials be stored on the instance and that access be granted using temporary credentials that expire automatically. What is the recommended approach?

Accepted Answer

Create an IAM role in Account B with a trust policy allowing the EC2 instance role in Account A to assume it, then have the application call AWS STS AssumeRole to obtain temporary credentials.

Answer

Create an IAM user in Account B with S3 read permissions and store its access keys as environment variables on the EC2 instance in Account A.

Answer

Attach a bucket policy in Account B granting public read access and have the application fetch objects anonymously.

Answer

Generate a long-lived access key for the EC2 instance role in Account A and add it to the bucket policy in Account B as a principal.