Rebecca Mader has been working as a cloud security engineer in an IT company located in Detroit, Michigan. Her organization uses AWS cloud-based…

AWS IAM Roles: AWS Identity and Access Management (IAM) roles allow for permissions to be

assigned to AWS resources without the use of static credentials. Roles provide temporary credentials

that are automatically rotated.

Service Role: The ‘get-pics’ service role created by Rebecca includes a permission policy for read-only

access to the S3 bucket and a trust policy that allows the EC2 instance to assume the role.

Temporary Credentials: When the application runs on the EC2 instance, it uses the temporary

credentials provided by the role to access the S3 bucket. These credentials are dynamically provided

and do not require developer management.

Developer and Admin Roles: Since the EC2 instance has the necessary permissions through the

service role, the developer does not need to manage credentials. Similarly, the admin does not need

to grant explicit permission to the developer because the permissions are already encapsulated

within the role.

Security Best Practices: This approach adheres to AWS security best practices by avoiding the sharing

of static credentials and minimizing the need for manual credential management.

Reference:

AWS’s official documentation on IAM roles.