Examkin

Question

Difficulty: MediumIAM Policies and Roles

An application is running on an Amazon EC2 instance in Account A (111111111111). The application needs to read data from an Amazon DynamoDB table in Account B (222222222222) by assuming an IAM role named CrossAccountDynamoDBRole in Account B. The EC2 instance is launched with an IAM instance profile associated with the IAM role EC2AppRole in Account A.

Which IAM trust policy must be attached to the CrossAccountDynamoDBRole in Account B to allow the EC2 application to assume it?


  1. {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::111111111111:role/EC2AppRole"
    },
    "Action": "sts:AssumeRole"
    }
    ]
    }
    Answer
  2. B

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "Service": "ec2.amazonaws.com"
    },
    "Action": "sts:AssumeRole"
    }
    ]
    }
  3. C

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::111111111111:instance-profile/EC2AppInstanceProfile"
    },
    "Action": "sts:AssumeRole"
    }
    ]
    }
  4. D

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::111111111111:role/EC2AppRole"
    },
    "Action": "dynamodb:GetItem"
    }
    ]
    }

Answer

The trust policy that allows the IAM role EC2AppRole from Account A to assume the role in Account B using the action sts:AssumeRole.
The correct trust policy designates the IAM role in Account A (arn:aws:iam::111111111111:role/EC2AppRole) as the trusted principal and allows the sts:AssumeRole action. When the application on the EC2 instance calls AssumeRole, AWS STS verifies that the trust policy of the target role in Account B allows this specific role to assume it.

Step-by-Step Solution

1
Identify the principal that needs to perform the assume role action.
The identity calling sts:AssumeRole is the IAM role EC2AppRole associated with the EC2 instance in Account A (111111111111).
Since the application runs under the credentials of EC2AppRole, the trust policy in Account B must explicitly target this role's ARN as the principal.
2
Select the correct Action for the trust policy.
The action must be sts:AssumeRole.
Trust policies govern role assumption and must specify sts:AssumeRole as the allowed action.
3
Construct the trust policy JSON.
A policy statement containing Effect: Allow, Principal: AWS referencing the role ARN, and Action: sts:AssumeRole.
This structure satisfies both the principal identity and the STS action requirements.

Key Concept

Cross-account IAM role trust relationships
Estimated Time:1m 30s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic