A developer is configuring a backend application running on an Amazon EC2 instance to send application logs to Amazon CloudWatch Logs. The developer creates an IAM role named `EC2LoggingRole` with the following permissions policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:us-east-1:123456789012:log-group:AppServerLogs:*"
}
]
}
During testing, the application fails to write to CloudWatch Logs with authorization errors. Which two configuration steps must the developer perform to resolve this issue and securely grant permissions to the application? (Select TWO.)
- Configure the trust policy of `EC2LoggingRole` to allow the `ec2.amazonaws.com` service principal to perform the `sts:AssumeRole` action.Answer
- Create an IAM instance profile, add `EC2LoggingRole` to it, and attach the instance profile to the EC2 instance.Answer
- CConfigure the trust policy of `EC2LoggingRole` to trust the `logs.amazonaws.com` service principal.
- DCreate an IAM user with access keys, attach `EC2LoggingRole` to the user, and hardcode the credentials within the application initialization code.
- EModify the permissions policy of `EC2LoggingRole` to list `logs.amazonaws.com` as the Principal under a new statement.
Answer
Configure the trust policy of the IAM role to allow the Amazon EC2 service principal to assume it, and associate the role with the instance by using an IAM instance profile.
The correct configuration requires defining a trust policy that permits the EC2 service principal to assume the role via the `sts:AssumeRole` action. Additionally, an IAM instance profile must be created to link the IAM role to the EC2 instance, allowing the AWS SDK on the instance to automatically retrieve temporary credentials from the Instance Metadata Service (IMDS).
Step-by-Step Solution
Key Concept
To grant AWS resource access to applications running on Amazon EC2 instances, you must configure a trust relationship on the IAM role for the EC2 service principal (`ec2.amazonaws.com`) and attach the role via an IAM instance profile.