Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is writing an AWS Lambda function that programmatically launches an Amazon EC2 instance using the AWS SDK. The EC2 instance requires an IAM role to access an Amazon S3 bucket. The developer has created the EC2 IAM role `EC2AccessS3Role` and an associated instance profile.

The Lambda function runs under an execution role with the following identity-based policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:DescribeInstances"
],
"Resource": "*"
}
]
}

When the Lambda function executes the code to launch the instance with the instance profile, the API call fails with a `Client.UnauthorizedOperation` error.

Which of the following actions will resolve this issue?

  1. A
    Modify the trust policy of the `EC2AccessS3Role` to allow the Lambda service (`lambda.amazonaws.com`) to assume the role.
  2. Add the `iam:PassRole` permission to the Lambda function's execution role policy, specifying the ARN of the `EC2AccessS3Role` as the resource.Answer
  3. C
    Modify the Lambda function's code to initialize the AWS SDK client using hardcoded AWS access keys of an IAM user that has administrative privileges.
  4. D
    Modify the trust policy of the Lambda execution role to allow the `EC2AccessS3Role` to assume the Lambda role.

Answer

The developer should add the `iam:PassRole` permission to the Lambda function's execution role, specifying the ARN of the EC2 IAM role as the resource.
The correct answer is to add the `iam:PassRole` permission to the Lambda execution role. To associate an IAM role with an EC2 instance during launch, the calling identity (the Lambda function) must have the `iam:PassRole` permission for the specific role being passed. This ensures that the user or service cannot escalate privileges by passing a role they are not authorized to use.

Step-by-Step Solution

1
Identify the action being performed when the error occurs.
The Lambda function is calling `ec2:RunInstances` and passing an IAM role (via an instance profile) to the EC2 instance.
The Lambda execution role has permission to run instances but fails with an unauthorized error when attempting to associate the role.
2
Apply the concept of delegation of permissions in AWS.
When an AWS service or user passes an IAM role to an AWS service, it requires the `iam:PassRole` permission.
AWS enforces the `iam:PassRole` permission to prevent users/services from passing roles with higher privileges than they themselves possess.
3
Configure the IAM policy.
Add an inline or managed policy to the Lambda execution role that allows `iam:PassRole` on the ARN of the EC2 role.
This allows the Lambda function's execution role to successfully delegate the EC2 role to the newly created EC2 instance.

Key Concept

IAM PassRole Permission
Rate this question

Topics

IAM Policies and Roles

More questions from this topic