An application running on an EC2 instance needs to access an Amazon DynamoDB table in a different AWS account. What is the MOST secure way to grant this access?

Answer options:

Create an IAM user in the target account and store the credentials on the EC2 instance.

Create an IAM role in the target account. Allow the EC2 instance's role to assume it.

Make the DynamoDB table public and use a VPC endpoint.

Use AWS Resource Access Manager (RAM) to share the DynamoDB table.

How to approach this question

Look for cross-account role assumption.

B.Create an IAM role in the target account. Allow the EC2 instance's role to assume it.✓ Correct

Create an IAM role in the target account with DynamoDB access. Attach a policy to the EC2 instance's role allowing it to assume the target role.

Assuming an IAM role across accounts provides temporary, secure credentials without hardcoding access keys.

Choosing IAM users/credentials instead of roles.

65 questions · hints · full answers · grading