Question

A CloudOps engineer discovers that an application running on EC2 instances authenticates to Amazon S3 using long-lived IAM user access keys that are hardcoded in a configuration file. A recent security audit flagged this as a compliance violation because the keys have not been rotated in over a year and could be exposed. The engineer must remediate the finding while ensuring the application continues to access S3 with the least operational overhead. What should the engineer do?

Accepted Answer

Create an IAM role with the required S3 permissions, attach it to the EC2 instances via an instance profile, and remove the hardcoded access keys from the application configuration.

Answer

Store the IAM user access keys in AWS Secrets Manager and configure the application to retrieve them at runtime, enabling automatic rotation every 90 days.

Answer

Enable AWS Config to automatically rotate the IAM user access keys every 30 days and update the application configuration file accordingly.

Answer

Apply a permission boundary to the IAM user that restricts access to only the required S3 bucket and enable MFA for the access keys.