Question

A development team has deployed a Python application on an Amazon EC2 instance. The application needs to read and write objects in an Amazon S3 bucket. Currently, the developers have embedded long-term IAM user access keys in the application's configuration file. A security review flagged this as a violation of AWS security best practices. Which solution should the solutions architect recommend to provide the application secure access to S3 while following the principle of least privilege?

Accepted Answer

Create an IAM role with a policy granting the required S3 permissions, attach it to the EC2 instance as an instance profile, and remove the hardcoded keys.

Answer

Store the IAM user access keys in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Answer

Rotate the embedded IAM user access keys every 30 days using a scheduled AWS Lambda function.

Answer

Configure a bucket policy that allows anonymous access from the EC2 instance's public IP address so the application no longer needs credentials.