An application on EC2 reads configuration files from S3.
Do not embed an access key in an AMI or source code; use short-lived credentials.
Which method is most appropriate?
Associate an IAM role through an instance profile so EC2 obtains temporary credentials for S3 access.
Detailed explanation
Removing authentication exposes data and violates least privilege.
Removing authentication exposes data and violates least privilege.
A KMS key ARN is not an IAM authentication credential.
A KMS key ARN is not an IAM authentication credential.
EC2 can obtain temporary role credentials without embedding a long-term access key.
EC2 can obtain temporary role credentials without embedding a long-term access key.
The secret can be exposed on the instance or in logs.
The secret can be exposed on the instance or in logs.
Check official documentation
Compare the following points with the official documentation.
IAM roles for EC2の公式説明を確認する。
What to confirm
EC2のIAMロールと長期アクセスキーの違いを説明できる。
Key points
- EC2 IAM role
- Instance profile
- Temporary credentials
Notes
- Environment: AWS公式IAM・EC2ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Credential lifecycle
Role credentials are rotated by the platform and avoid long-lived application secrets.
Least privilege
The role policy can be limited to the required S3 bucket and read actions.