Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is deploying a Java application on Amazon EC2 instances in AWS account `123456789012`. The application requires access to retrieve database credentials from AWS Systems Manager Parameter Store. The developer creates an IAM role named `SSMParameterReaderRole` and attaches a permissions policy that allows the `ssm:GetParameter` action. The developer then configures an Amazon EC2 Instance Profile to associate the EC2 instances with this role. During startup, the application fails to retrieve the parameters, and CloudTrail logs show that the EC2 service was unable to assume the role.

The trust policy currently attached to `SSMParameterReaderRole` is as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification must the developer make to the trust policy of `SSMParameterReaderRole` to resolve this issue?

  1. A
    Attach a permissions policy directly to the Amazon EC2 instances that grants the `sts:AssumeRole` permission for the IAM role.
  2. B
    Change the trust policy's Action field to specify the `ssm:GetParameter` API action instead of the `sts:AssumeRole` API action.
  3. Update the trust policy's Principal block to specify the EC2 service principal (`"Service": "ec2.amazonaws.com"`) instead of the AWS account root principal.Answer
  4. D
    Modify the application's SDK client configuration to hardcode the IAM role's temporary credentials directly in the code.

Answer

Update the trust policy's Principal block to specify the EC2 service principal (`"Service": "ec2.amazonaws.com"`) instead of the AWS account root principal.
The correct answer is to update the trust policy's Principal block to specify the EC2 service principal. When an application runs on an EC2 instance and uses an instance profile, the EC2 service must assume the associated IAM role on behalf of the instance. Therefore, the IAM role's trust policy must trust the service principal `ec2.amazonaws.com` rather than the AWS account root principal, which only allows IAM identities within the account to assume the role via direct STS calls.

Step-by-Step Solution

1
Analyze the CloudTrail error indicating that the Amazon EC2 service is unable to assume the IAM role.
Identified that the issue is with the trust relationship of the IAM role, which defines which principals are allowed to assume it.
To allow a service like EC2 to assume a role, the trust policy must explicitly grant permission to that service principal.
2
Examine the current trust policy of the IAM role.
Observed that the Principal is set to the AWS account root (`arn:aws:iam::123456789012:root`) rather than the service principal.
The current configuration only allows IAM users or roles within the account to assume this role via STS, not the EC2 service itself.
3
Update the Principal field in the trust policy to specify the EC2 service principal.
The Principal is modified to `"Service": "ec2.amazonaws.com"`.
This allows the EC2 service to successfully perform `sts:AssumeRole` on behalf of the instance, enabling the application to access AWS resources using the instance profile.

Key Concept

IAM Role Trust Policy vs Permissions Policy
Estimated Time:1m 30s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic