A team is developing an application that is deployed on Amazon EC2 instances. During testing, the team receives an error. The EC2 instances are unable to access an Amazon S3 bucket. Which steps should the team take to troubleshoot this issue? (Select TWO.)

Access to an Amazon S3 bucket from an EC2 instance is determined by evaluating all applicable policies. This includes the identity-based policy attached to the IAM role of the EC2 instance and the resource-based policy (bucket policy) attached to the S3 bucket itself. For a request to succeed, it must be allowed by the relevant policies and not be explicitly denied by any policy. Therefore, the two primary locations to check for permission misconfigurations are the IAM role associated with the EC2 instance and the S3 bucket policy. Both must permit the intended action.

C. IAM users are not attached to EC2 instances; IAM roles are attached via an instance profile. Using static user credentials on an instance is not a security best practice.
D. S3 Lifecycle policies are used to manage the lifecycle of objects (e.g., transitioning storage class or deleting objects) and do not control access permissions for principals.
E. Security groups act as a virtual firewall, controlling network traffic to and from an instance. While they can block connectivity, they do not manage IAM permissions, which are the typical cause of access errors.

1. AWS Identity and Access Management User Guide

"Determining whether a request is allowed or denied within an account". This section explains that for a request to be authorized

there must be an applicable Allow statement in either the identity-based or resource-based policy

and no applicable Deny statement in either. This supports checking both the IAM role (A) and the bucket policy (B).

2. Amazon Simple Storage Service User Guide

"Identity and access management in Amazon S3"

Section: "How Amazon S3 authorizes a request". The documentation states

"When an AWS account receives a request

AWS enforcement code evaluates all policies that are applicable to the request context... This includes user-based policies [IAM policies] and resource-based policies [bucket policies]."

3. Amazon EC2 User Guide for Linux Instances

"IAM roles for Amazon EC2". This guide specifies

"We recommend that you use an IAM role to manage temporary credentials for applications that run on an EC2 instance." This confirms that checking the IAM role (A) is the correct approach

not an IAM user (C).

4. Amazon Simple Storage Service User Guide

"Managing your storage lifecycle". This document defines lifecycle configuration as a feature to automate object management

such as transitioning objects to different storage classes or deleting them. It is not an access control mechanism

which invalidates option D.