To enable an application on an EC2 instance to perform some actions, the developer requires to grant access to the application for a few AWS resources. The developer plans to provide his credential to the instance. However, as the developer’s credentials are long-term, the developer is looking for an alternate to reduce the security risk.
What can the developer do in this scenario to enable applications on EC2 to get access to the required AWS resources temporarily?

Answer options:

A.Use “IAM Roles”
B.Use “IAM Group”
C.Use “IAM Tags”
D.There is no alternate way. A developer needs to give his credentials and revoke access when the required action is done.

Answer: A
IAM roles facilitate access delegation to services/users that in general do not have access to AWS resources of your organization. Users could assume the role (IAM Users) and/or services (AWS services) for getting temporary security credentials. This can then be used to perform the required actions.
An IAM group is a service to grant/revoke/manage permissions on a collection of IAM users.
IAM tags add custom attributes to IAM users or roles. IAM tags use key-value pairs.
Option A is CORRECT as the IAM role can enable applications on EC2 to get access to the required AWS resources temporarily.
Option B is INCORRECT because the IAM group is a collection of IAM Users and helps in access management.
Option C is INCORRECT because IAM tags are simply “labels” that add custom attributes to the users/roles.
Option D is INCORRECT because we can use IAM Roles in the scenario.
Reference:
https://aws.amazon.com/iam/features/manage-roles/
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html