Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring an application running on an Amazon EC2 instance in Account B (444455556666444455556666) to read objects from an Amazon S3 bucket named `data-bucket` located in Account A (111122223333111122223333). The EC2 instance uses an IAM instance profile with an IAM role named `ReaderRole`.

The developer has attached the following IAM policy to `ReaderRole` in Account B:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::data-bucket/*"
}
]
}

However, the application receives an AccessDenied error when attempting to download objects from `data-bucket`.

Which action should the developer take to resolve this error?

  1. A
    Update the trust policy of ReaderRole in Account B to allow the Amazon S3 service principal (s3.amazonaws.com) to assume the role.
  2. B
    Embed the AWS access key and secret access key of an IAM user from Account A directly into the application's initialization code.
  3. Add a bucket policy to data-bucket in Account A that grants s3:GetObject permissions to the principal arn:aws:iam::444455556666:role/ReaderRole.Answer
  4. D
    In Account A, add a bucket policy to data-bucket that grants s3:GetObject permissions, specifying the EC2 Instance Profile ARN as the principal.

Answer

Add a bucket policy to the S3 bucket in Account A that explicitly allows the IAM role from Account B to access the objects.
For cross-account S3 access, permissions must be granted in two locations: the identity-based IAM policy in the trusted account (Account B) must allow the action, and the resource-based S3 bucket policy in the trusting account (Account A) must trust the caller's identity. Because the identity-based policy is already correctly configured in Account B, adding the bucket policy in Account A that references the caller's IAM role ARN resolves the authorization gap.

Step-by-Step Solution

1
Analyze cross-account permissions requirements.
Determine that cross-account S3 access requires authorization from both the identity-based policy in the caller's account (Account B) and the resource-based policy in the resource owner's account (Account A).
By default, cross-account access is denied unless both accounts explicitly grant permission.
2
Draft a bucket policy for the S3 bucket in Account A.
Identify that the principal in the bucket policy must target the specific IAM role ARN (arn:aws:iam::444455556666:role/ReaderRole) rather than the instance profile or the entire account.
Specifying the IAM role ARN follows the principle of least privilege, restricting access only to the container/instance running the application.
3
Apply the bucket policy in Account A.
The bucket policy is applied, linking the IAM role to the S3 resource permission, resolving the AccessDenied error.
With both policies permitting the action, the IAM evaluation engine successfully authorizes the request.

Key Concept

Cross-Account IAM Resource Authorization
Rate this question

Topics

IAM Policies and Roles

More questions from this topic