Examkin

Question

Difficulty: MediumIAM Policies and Roles

An application running on an Amazon EC2 instance is designed to fetch daily configuration files from a private Amazon S3 bucket. During deployment, the application throws an Access Denied exception when attempting to call the `s3:GetObject` API operation. The developer has attached a policy with the required S3 permissions to an IAM role called `S3ReaderRole`, which is associated with the instance profile. Upon inspecting the role's trust policy, the developer finds the following configuration:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following modifications should the developer make to resolve this access issue?

  1. A
    Add a new statement to the S3ReaderRole's permissions policy that allows the sts:AssumeRole action for the ec2.amazonaws.com service principal.
  2. Modify the trust policy of the S3ReaderRole to change the service principal in the Principal block to ec2.amazonaws.com.Answer
  3. C
    Initialize the S3 client in the Java application code using hardcoded AWS access keys belonging to an IAM user with S3 read access.
  4. D
    Modify the S3ReaderRole's trust policy to change the Action element from sts:AssumeRole to s3:GetObject.

Answer

Modify the trust policy of the S3ReaderRole to change the service principal in the Principal block to ec2.amazonaws.com.
Modifying the trust policy of the IAM role to change the service principal to ec2.amazonaws.com is correct because it grants the EC2 service permission to assume the role. The trust policy defines which entities (in this case, the EC2 service) are allowed to assume the role to obtain temporary credentials. Since the application is running on EC2, the role's trust policy must trust EC2, not Lambda.

Step-by-Step Solution

1
Identify the execution environment of the application and the resource it is attempting to access.
The application is running on an Amazon EC2 instance and needs to read files from an Amazon S3 bucket.
Understanding the execution context helps determine which service principal must assume the IAM role.
2
Examine the current IAM trust policy configuration of the role associated with the EC2 instance.
The trust policy currently has the Principal.Service set to lambda.amazonaws.com.
This principal only allows the AWS Lambda service to assume the role, preventing EC2 from obtaining the necessary temporary security credentials.
3
Update the trust policy to reference the correct service principal.
Change the Principal.Service element value to ec2.amazonaws.com.
This allows the EC2 service principal to assume the role, enabling the EC2 instance profile to fetch and hand over temporary credentials to the running application.

Key Concept

IAM Trust Policies vs. Permissions Policies
Rate this question

Topics

IAM Policies and Roles

More questions from this topic