Q1 — IAM roles for EC2
A company wants to allow its EC2 instances to access S3 buckets without embedding credentials in the application code. What is the recommended approach?
- A. Store AWS credentials in environment variables on the EC2 instance
- B. Create an IAM user, generate access keys, and place them in ~/.aws/credentials
- C. Attach an IAM role with the appropriate S3 permissions to the EC2 instance
- D. Use a KMS-encrypted credentials file on the instance
- Correct answer:
Q2 — Explicit deny
An admin needs to grant a developer all S3 actions on a specific bucket but must ensure s3:DeleteBucket can never be executed regardless of any other permissions. Which configuration achieves this?
- A. Attach a managed policy allowing all S3 actions on the bucket
- B. Attach a managed policy allowing all S3 actions and a separate statement explicitly denying s3:DeleteBucket
- C. Use only a resource-based bucket policy granting all S3 access
- D. Attach a policy with Allow for all S3 actions; unlisted actions are automatically denied
- Correct answer:
Q3 — IAM policy elements
Which IAM policy element specifies which AWS service actions are permitted or denied?