Exam AWS-SysOps topic 1 question 760 discussion

A - as per best practice. Create a role. In this case, create a role with needed permissions, attach it to the EC2.

A. Create an IAM EC2 role for the EC2 instances and grant the role permission to read the Systems Manager parameters

By creating an IAM EC2 role and assigning it to the EC2 instances, you can securely manage and grant the necessary permissions to access the Systems Manager parameters. This approach eliminates the need to manage individual IAM users or credentials, reducing the risk of exposure and enhancing security.

A is the answer

A and C are good but C is better: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html Applications that run on an EC2 instance must include AWS credentials in their AWS API requests. You could have your developers store AWS credentials directly within the EC2 instance and allow applications in that instance to use those credentials. But developers would then have to manage the credentials and ensure that they securely pass the credentials to each instance and update each EC2 instance when it's time to rotate the credentials. That's a lot of additional work. Instead, you can and should use an IAM role to manage temporary credentials for applications that run on an EC2 instance. When you use a role, you don't have to distribute long-term credentials (such as a user name and password or access keys) to an EC2 instance. Instead, the role supplies temporary permissions that applications can use when they make calls to other AWS resources. When you launch an EC2 instance, you specify an IAM role to associate with the instance. Applications that run on the instance can then use the role-supplied temporary credentials to sign API requests.

Correct Answer: A AWS Best Practice is creating a role and assigning it to the instance.

A is the answer

A. Create an IAM EC2 role for the EC2 instances and grant the role permission to read the Systems Manager parameters

To access EC2 instances, the role your AWS account needs is an IAM instance profile

I'll go with A

A - as per best practice. Create a role.

Answer A is better - A. Create an IAM EC2 role for the EC2 instances and grant the role permission to read the Systems Manager parameters

It should be A