Ravi Sir's Cyber Security Cards › Interview Cards
How should EC2 reach S3 and RDS without access keys in code?
How should EC2 reach S3 and RDS without access keys in code? Attach an IAM role to the EC2 instance with least-privilege access to the exact bucket and actions. The role lets the app read one S3 bucket. No access keys sit in the code. “I use an instance role, not keys in code, and keep RDS private w
Read card text
What this card says
Short answer
Attach an IAM role to the EC2 instance with least-privilege access to the exact bucket and actions.
Example
The role lets the app read one S3 bucket. No access keys sit in the code.
Say it in the interview
“I use an instance role, not keys in code, and keep RDS private with the app SG on 3306.”
Why it matters
Keys in code get leaked to git. A role has no key to leak.
Learn more in the lesson: 46.5 Domains, S3, RDS and Live-Project Security Questions