Exam AWS Certified Solutions Architect - Professional topic 1 question 93 discussion

A: "...and associate the Role to the application instances by referencing an instance profile" C: "...and reference the Role in the instance profile property of the application instance" The correct answer is not C, as the instance profile property of an instance doesn't refer to an IAM Role, it refers to an Instance Profile, which is a resource in its own right. Therefore, the correct answer is A.

The correct answer is C. You've got to take a closer look at the difference between A & C

A. Create an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and associate the Role to the application instances by referencing an instance profile.

I would go to A like TigerInTheCloud say: I prefer A. Normally we, at least me, use the term "attach" or "associate". AWS CLI iam subcommand 'add-role-to-instance-profile' and ec2 subcommand 'associate-iam-instance-profile' perform the task. Also, just checked, term, associate not reference, is used in AWS document. C is not wrong , is true that we reference the Role in the instance profile, but we just do not use that term. We use attach or associate.

The correct answer is option C: Create an Identity and Access Management (IAM) Role that has the required permissions to read and write from the required DynamoDB table and reference the Role in the instance profile property of the application instance. By creating an IAM Role and associating it with the instance profile of the application instances, you can grant the necessary permissions to access DynamoDB without exposing API credentials. The IAM Role acts as a set of temporary security credentials that can be assumed by the instances. This approach follows the recommended security best practices of AWS.

English test :-) I prefer A. Normally we, at least me, use the term "attach" or "associate". AWS CLI iam subcommand 'add-role-to-instance-profile' and ec2 subcommand 'associate-iam-instance-profile' perform the task. Also, just checked, term, associate not reference, is used in AWS document, https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html

C. Create an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and reference the Role in the instance profile property of the application instance.