An application on EC2 needs to access Amazon S3.
Grant only the required permissions without storing long-term access keys on the instance.
Which design is most appropriate?
Attach an IAM role through an instance profile so the application can obtain temporary credentials without storing long-term keys on the EC2 instance.
Detailed explanation
Embedding root credentials creates a severe exposure and violates least-privilege and credential-protection principles.
Embedding root credentials creates a severe exposure and violates least-privilege and credential-protection principles.
An IAM role supplies temporary credentials and avoids storing long-term access keys on the instance.
An IAM role supplies temporary credentials and avoids storing long-term access keys on the instance.
Public access is not limited to the required EC2 application.
Public access is not limited to the required EC2 application.
Copies or leaks of the AMI would spread a long-term credential.
Copies or leaks of the AMI would spread a long-term credential.
Check official documentation
Compare the following points with the official documentation.
IAM roles for EC2の公式ドキュメントで一時認証情報の仕組みを確認する。
What to confirm
EC2へ長期アクセスキーを保存せず、ロールで最小権限を付与できる。
Key points
- IAM role
- Instance profile
- Temporary credentials
- Least privilege
Notes
- Environment: AWS公式IAM・EC2ドキュメントの確認
- Confirm current AWS service behavior and security guidance in the official documentation.
Foundation review
Workload identity
The instance obtains credentials at runtime, so a long-term key does not have to be copied into the application.
Responsibility boundary
The role grants permissions, while the EC2 instance profile supplies that role to the workload.