Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring a Python application running on an Amazon EC2 instance in Account A (111122223333111122223333) to retrieve files from a private Amazon S3 bucket located in Account B (444455556666444455556666). The EC2 instance is associated with an IAM instance profile utilizing a role named `EC2ReadRole`. The developer creates an IAM role named `S3AccessRole` in Account B. However, when the application attempts to assume the role, it receives an `AccessDenied` error. The trust policy for `S3AccessRole` in Account B is currently configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/EC2ReadRole"
},
"Action": "sts:AssumeRole"
}
]
}

Which two configuration steps must the developer perform to successfully establish this cross-account access and resolve the `AccessDenied` error? (Select TWO.)

  1. Attach a permissions policy to the EC2ReadRole in Account A that allows the sts:AssumeRole action on the arn:aws:iam::444455556666:role/S3AccessRole resource.Answer
  2. Attach a permissions policy to the S3AccessRole in Account B that allows the s3:GetObject action on the target S3 bucket resource.Answer
  3. C
    Add a statement to the S3AccessRole permissions policy in Account B that allows the sts:AssumeRole action targeting the EC2ReadRole ARN.
  4. D
    Modify the S3 bucket policy in Account B to allow the sts:AssumeRole action for the EC2ReadRole ARN.
  5. E
    Modify the application code on the EC2 instance to initialize the AWS SDK client with hardcoded AWS access keys of an IAM user from Account B.

Answer

To resolve the AccessDenied error and secure cross-account access, the developer must attach a permissions policy to the EC2 role in Account A allowing it to perform the assume-role action on the target role, and attach an IAM policy to the target role in Account B allowing it to perform the S3 read operations.
For cross-account access via role assumption, both sides of the trust and delegation must be configured. The EC2ReadRole in Account A must have permissions to execute the sts:AssumeRole call (as described in the option to attach a permissions policy to EC2ReadRole), and the assumed S3AccessRole in Account B must be authorized to perform the s3:GetObject operations on the target bucket (as described in the option to attach an S3 permissions policy to S3AccessRole).

Step-by-Step Solution

1
Analyze the IAM trust relationship configuration.
The trust policy on S3AccessRole in Account B correctly lists Account A's EC2ReadRole as a trusted entity that can execute sts:AssumeRole.
This verifies that Account B permits Account A to assume the role, meaning the issue must lie in Account A's permissions or the permissions of the assumed role.
2
Configure the permissions of the calling identity in Account A.
Attach an IAM policy to EC2ReadRole in Account A allowing the sts:AssumeRole action on the ARN of S3AccessRole.
By default, IAM roles have no outbound permissions unless explicitly granted. The EC2 role must have permission to request the STS token.
3
Configure the permissions of the assumed role in Account B.
Attach an IAM policy to S3AccessRole in Account B allowing the s3:GetObject action on the target S3 bucket.
When the application assumes S3AccessRole, it inherits only the permissions assigned to that role. It must be explicitly permitted to perform S3 actions on the target resource.

Key Concept

IAM trust policies define which entities are trusted to assume a role, while permissions policies define what actions the assumed role can perform on AWS resources.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic