An application on an EC2 instance must write to S3. Which credential approach follows AWS best practice?
A.Store long-term access keys in the app's config file
Static keys leak, don't rotate, and end up in repos.
B.Attach an IAM role to the instance via an instance profile — the SDK retrieves rotating credentials from instance metadata automatically
Correct. Role + instance profile = no stored credentials at all.
C.Embed IAM user credentials as environment variables
Same problem as A, just in env vars.
D.Use the root account's access keys
Root keys are maximum privilege — never used for apps.
Why this answer
Instance profiles attach an IAM role to EC2 — the SDK picks up short-lived, automatically rotated credentials from IMDS with zero secrets in code. Any static-key approach loses to this on the exam, every time.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security