AWS Certified Developer – Associate (DVA-C02) — Question 289

A company has an application that is hosted on Amazon EC2 instances. The application stores objects in an Amazon S3 bucket and allows users to download objects from the S3 bucket. A developer turns on S3 Block Public Access for the S3 bucket. After this change, users report errors when they attempt to download objects. The developer needs to implement a solution so that only users who are signed in to the application can access objects in the S3 bucket.

Which combination of steps will meet these requirements in the MOST secure way? (Choose two.)

Answer options

• A. Create an EC2 instance profile and role with an appropriate policy. Associate the role with the EC2 instances.
• B. Create an IAM user with an appropriate policy. Store the access key ID and secret access key on the EC2 instances.
• C. Modify the application to use the S3 GeneratePresignedUrl API call.
• D. Modify the application to use the S3 GetObject API call and to return the object handle to the user.
• E. Modify the application to delegate requests to the S3 bucket.

Correct answer: A, C

Explanation

Using an IAM role attached to the EC2 instances via an instance profile (Option A) is the AWS-recommended best practice for securely granting permissions without hardcoding credentials, making Option B insecure. Generating presigned URLs (Option C) allows the application to securely delegate short-term download access to authenticated users while keeping the S3 bucket private, whereas the other options either fail to bypass the Block Public Access block or expose credentials.