An application on EC2 reads objects from S3.
The solution must avoid embedding long-term access keys in application code.
Which authentication method is appropriate?
Attach an IAM role to the EC2 instance so the application can obtain temporary credentials through the instance profile.
Detailed explanation
Embedding a powerful long-term credential makes accidental disclosure and account compromise more likely.
Embedding a powerful long-term credential makes accidental disclosure and account compromise more likely.
Sharing personal long-term credentials makes rotation, accountability, and revocation difficult.
Sharing personal long-term credentials makes rotation, accountability, and revocation difficult.
Public access removes access control and does not satisfy a protected-data requirement.
Public access removes access control and does not satisfy a protected-data requirement.
The role supplies temporary credentials to applications on the instance without storing a long-term key in code.
The role supplies temporary credentials to applications on the instance without storing a long-term key in code.
Check official documentation
Compare the following points with the official documentation.
IAM User GuideのIAM rolesとEC2 instance profileの説明を確認する。実環境ではIAM権限と料金影響を確認する。
What to confirm
EC2上のアプリケーションがロールの一時認証情報でS3へアクセスする。
Key points
- IAM role
- Instance profile
- Temporary credentials
Notes
- Environment: AWS公式IAM・EC2ドキュメントの確認
- Confirm current IAM capabilities and recommended practices in the official AWS documentation.
Foundation review
Workload identity
An EC2 role lets the SDK obtain credentials without a customer-managed long-term key.
Secret exposure
Source files and machine images are poor places for reusable long-term credentials.