Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring an Amazon API Gateway REST API to send incoming event data directly to an Amazon Kinesis data stream using a service proxy integration. To authorize this integration, the developer creates an IAM role named `APIGatewayKinesisRole` with a permissions policy that allows `kinesis:PutRecord` on the target stream. However, when testing the API Gateway integration, the developer receives an error indicating that API Gateway is not authorized to assume the role. The developer inspects the trust policy of `APIGatewayKinesisRole`, which is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "kinesis.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

How should the developer resolve this authorization error?

  1. Change the Service principal in the trust policy to apigateway.amazonaws.com.Answer
  2. B
    Change the Action in the trust policy to kinesis:PutRecord and keep kinesis.amazonaws.com as the principal.
  3. C
    Generate temporary access keys using AWS Security Token Service (STS) and hardcode them in the API Gateway integration request mapping template.
  4. D
    Attach an identity-based policy to APIGatewayKinesisRole that allows sts:AssumeRole on the API Gateway REST API resource.

Answer

Change the Service principal in the trust policy to apigateway.amazonaws.com.
To resolve the authorization issue, the service principal in the trust policy must be changed to apigateway.amazonaws.com. This tells IAM that the API Gateway service is trusted to assume the role. When API Gateway executes the integration, it calls sts:AssumeRole on the specified role to get temporary credentials with the permissions defined in the attached policy (which allows kinesis:PutRecord).

Step-by-Step Solution

1
Analyze the error message and the configuration.
The error indicates that API Gateway is unable to assume the role. The trust policy defines the principal as kinesis.amazonaws.com.
To find why the assume role action fails, we must verify if the correct entity is allowed to assume the role.
2
Identify the service executing the action.
Amazon API Gateway is the service that needs to assume the role to send data to the Kinesis data stream.
The trust policy principal must designate the service requesting the role assumption.
3
Correct the principal in the trust policy.
Change the principal from kinesis.amazonaws.com to apigateway.amazonaws.com.
This allows the API Gateway service to successfully call sts:AssumeRole and acquire temporary credentials.

Key Concept

IAM trust policy service principal configuration
Rate this question

Topics

IAM Policies and Roles

More questions from this topic