Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring an Amazon EventBridge Scheduler schedule to send messages to an Amazon SQS queue named OrderProcessingQueue in the same AWS account. The schedule is failing to deliver messages, and execution metrics show access denied errors.

Which two configurations are required to resolve this permissions issue? (Select TWO.)

  1. Configure the trust policy of the EventBridge Scheduler IAM execution role to allow the scheduler.amazonaws.com service principal to assume the role using the sts:AssumeRole action.Answer
  2. Attach a permissions policy to the EventBridge Scheduler IAM execution role that allows the sqs:SendMessage action on the arn:aws:sqs:us-east-1:123456789012:OrderProcessingQueue resource.Answer
  3. C
    Configure the trust policy of the EventBridge Scheduler IAM execution role to allow the sqs.amazonaws.com service principal to assume the role using the sts:AssumeRole action.
  4. D
    Attach a permissions policy to the EventBridge Scheduler IAM execution role that allows the sts:AssumeRole action on the arn:aws:sqs:us-east-1:123456789012:OrderProcessingQueue resource.
  5. E
    Configure the EventBridge Scheduler target payload to pass temporary credentials by setting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables inside the message body.

Answer

To resolve the permissions issue, the developer must configure a trust policy on the IAM role that allows the EventBridge Scheduler service principal (scheduler.amazonaws.com) to assume the role, and attach an IAM permissions policy to that execution role that allows the sqs:SendMessage action on the specific target SQS queue resource.
For Amazon EventBridge Scheduler to deliver messages to Amazon SQS, it must assume an execution role. This requires a trust policy allowing the Scheduler service principal (scheduler.amazonaws.com) to assume the role, and a permissions policy attached to the role that grants the sqs:SendMessage permission on the target SQS queue.

Step-by-Step Solution

1
Identify the service principal that needs to assume the role.
The service principal scheduler.amazonaws.com requires trust permission to assume the role.
Since EventBridge Scheduler is running the task, it must be allowed to assume the IAM role to perform actions on your behalf.
2
Configure the trust relationship on the IAM role.
Add scheduler.amazonaws.com to the trust policy with the sts:AssumeRole action.
This establishes trust between IAM and the Scheduler service.
3
Grant SQS permissions to the execution role.
Attach an IAM permissions policy to the role that allows sqs:SendMessage on the specific SQS queue ARN.
This gives the assumed role the required permissions to deliver the messages to the SQS queue.

Key Concept

IAM execution roles require both a trust policy (allowing the service principal to assume the role) and a permissions policy (granting the role access to target resources).
Rate this question

Topics

IAM Policies and Roles

More questions from this topic