Question

A company runs a data analytics platform in a dedicated Analytics AWS account. Data is stored in an S3 bucket in a separate Data account. The analytics application runs on EC2 instances in the Analytics account and must read objects from the Data account bucket. The security team requires that no long-term access keys be stored on the EC2 instances and that access follow the principle of least privilege. Which approach meets these requirements?

Accepted Answer

Create an IAM role in the Data account with a policy allowing read access to the bucket and a trust policy allowing the Analytics account's EC2 instance role to assume it; the instance role calls STS AssumeRole to obtain temporary credentials.

Answer

Generate IAM user access keys in the Data account, store them in a file on the EC2 instances, and reference them from the application when calling S3.

Answer

Enable public read access on the S3 bucket and restrict it with a bucket policy that references the Analytics account ID.

Answer

Create an IAM user in the Analytics account and attach an identity policy granting s3:GetObject on the Data account bucket ARN, then use that user's credentials on the instances.