Question

A company runs a data-processing application on EC2 instances that must read objects from an S3 bucket. A security engineer creates an IAM role with an S3 read policy and attaches it to an instance profile, but the EC2 instances cannot assume the role and receive an error. The role's trust policy currently lists the AWS account root as the trusted principal. What change to the trust policy will allow the EC2 instances to assume the role?

Accepted Answer

Set the Principal to the Service "ec2.amazonaws.com" so the EC2 service can assume the role via the instance profile.

Answer

Set the Principal to the Service "s3.amazonaws.com" because the role is used to access S3.

Answer

Add each EC2 instance ID as an AWS principal in the trust policy's Principal element.

Answer

Attach the S3 read policy as a resource-based policy on the bucket instead of using a trust policy.