An application on an EC2 instance needs to read from an S3 bucket. Which credential approach should be used?
Show answer and explanation
Answer: B
An instance profile delivers short-lived credentials to the instance metadata service, and the SDK refreshes them before they expire. Nothing long-lived sits on disk, and the permissions can be narrowed or revoked by editing the role.
Requiring IMDSv2 adds session-token protection against server-side request forgery attempts to read the credentials.
Why the other options are wrong
- A. Keys written to the volume are long-lived, easy to leak through backups or snapshots, and must be rotated by hand.
- C. Root credentials grant unrestricted access and should never be used by an application.
- D. A shared user destroys attribution, and rotating its keys breaks every instance at once.