Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is deploying an application on an Amazon EC2 instance. The application is configured to read configuration templates from an Amazon S3 bucket. The developer creates an IAM role named `AppConfigReadRole` with an attached policy that allows `s3:GetObject` on the target bucket. However, the application fails to retrieve the templates and receives an 'Access Denied' error. The developer inspects the trust policy of `AppConfigReadRole` and finds the following document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following modifications to the trust policy will resolve the Access Denied error and allow the EC2 instance to assume the role?

  1. A
    Modify the trust policy statement to allow the `s3:GetObject` action instead of `sts:AssumeRole`.
  2. B
    Embed the AWS Access Key ID and Secret Access Key of a security administrator directly in the application code.
  3. Change the principal service in the trust policy from `lambda.amazonaws.com` to `ec2.amazonaws.com`.Answer
  4. D
    Change the principal service in the trust policy to `ecs-tasks.amazonaws.com` and attach it to the EC2 host's task execution role.

Answer

Changing the service principal in the trust policy from `lambda.amazonaws.com` to `ec2.amazonaws.com`.
The trust policy of an IAM role determines which principals are allowed to assume it. For an application running on an Amazon EC2 instance to assume a role via an instance profile, the role's trust policy must specify the EC2 service principal (`ec2.amazonaws.com`) under the `Principal.Service` key, along with the `sts:AssumeRole` action. The original policy mistakenly trusted the Lambda service principal (`lambda.amazonaws.com`), which prevented the EC2 instance from assuming the role.

Step-by-Step Solution

1
Identify the compute environment where the application is running.
The application is running on an Amazon EC2 instance.
Understanding the host environment determines which AWS service principal needs permission to assume the IAM role.
2
Examine the trust policy of the `AppConfigReadRole` IAM role.
The principal is currently set to `lambda.amazonaws.com`.
An incorrect principal in a trust policy prevents the target service (EC2) from obtaining temporary credentials to assume the role.
3
Update the trust policy principal to match the hosting service.
Replace `lambda.amazonaws.com` with `ec2.amazonaws.com` in the trust policy.
This configures the role to trust the EC2 service, allowing the EC2 instance profile to successfully assume the role and access the S3 bucket.

Key Concept

IAM Role Trust Policies vs Permission Policies for EC2 Instances
Rate this question

Topics

IAM Policies and Roles

More questions from this topic