A Spark helper on EC2 reads and writes S3.
Do not distribute an access key to each instance.
Which authentication approach is most appropriate?
Associate an IAM role through an instance profile and use the temporary credentials exposed to the instance.
Detailed explanation
Audit logs do not authenticate an EC2 API request.
Audit logs do not authenticate an EC2 API request.
The instance can obtain temporary credentials without embedding a long-lived key.
The instance can obtain temporary credentials without embedding a long-lived key.
Cloned images and logs could expose the credential.
Cloned images and logs could expose the credential.
Any party could modify the data.
Any party could modify the data.
Check official documentation
Compare the following points with the official documentation.
AWS IAM roles for Amazon EC2、instance profiles、IMDSv2の公式説明を確認する。
What to confirm
AMIへのキー埋め込みとInstance profileの違いを説明できる。
Key points
- Instance profile
- IMDSv2
- Temporary credentials
- EC2
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Credential protection
Require IMDSv2 and review proxy behavior to reduce metadata credential theft.
Role separation
Use different roles for different instance groups and avoid unnecessary writes.