Examkin

Question

Difficulty: HardIAM Policies and Roles

A developer is deploying a containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate in Account A (111111111111111111111111). The application must assume an IAM role named `CrossAccountDynamoDBAccess` in Account B (222222222222222222222222) to perform read operations on a DynamoDB table.

The task definition in Account A is configured with an ECS Task Role named `TaskRole` and an ECS Task Execution Role named `TaskExecutionRole`. The developer configures the trust policy for the `CrossAccountDynamoDBAccess` role in Account B as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs-tasks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the container starts, the application throws an `AccessDenied` error when calling the AWS Security Token Service (STS) `AssumeRole` API.

How should the developer modify the configuration to resolve this issue and grant the application access using the principle of least privilege?

  1. Update the trust policy of `CrossAccountDynamoDBAccess` in Account B to specify the principal as `"AWS": "arn:aws:iam::111111111111:role/TaskRole"`. Additionally, attach a policy to `TaskRole` in Account A that allows `sts:AssumeRole` on the `CrossAccountDynamoDBAccess` role ARN.Answer
  2. B
    Update the trust policy of `CrossAccountDynamoDBAccess` in Account B to specify the principal as `"AWS": "arn:aws:iam::111111111111:role/TaskExecutionRole"`. Additionally, attach a policy to `TaskExecutionRole` in Account A that allows `sts:AssumeRole` on the `CrossAccountDynamoDBAccess` role ARN.
  3. C
    Configure the application code to initialize the AWS SDK client using hardcoded AWS access keys of an IAM user created in Account A. Update the trust policy of `CrossAccountDynamoDBAccess` in Account B to specify the principal as the ARN of that IAM user.
  4. D
    Modify the trust policy of `TaskRole` in Account A to specify the principal as `"AWS": "arn:aws:iam::222222222222:role/CrossAccountDynamoDBAccess"`. Attach a policy to `CrossAccountDynamoDBAccess` in Account B that allows `sts:AssumeRole` on `TaskRole`.

Answer

Update the trust policy of the cross-account role in Account B to trust the ARN of the ECS Task Role, and attach an IAM policy to the ECS Task Role in Account A allowing it to assume the cross-account role.
The correct solution involves modifying the trust policy of the cross-account role in Account B to trust the specific IAM role associated with the running application container (the Task Role in Account A). Additionally, the Task Role in Account A must be granted permission to call the Security Token Service (STS) AssumeRole API on the role in Account B. This allows the application to assume the role using temporary credentials retrieved via the ECS Task Role, complying with the principle of least privilege.

Step-by-Step Solution

1
Identify the role that executes the application code in ECS.
The containerized application runs using the permissions of the ECS Task Role (`TaskRole`), not the ECS Task Execution Role (`TaskExecutionRole`).
The Task Execution Role is for container agent operations (like pulling images and shipping logs), whereas the Task Role provides AWS API credentials directly to the containerized application.
2
Determine the required trust policy for the cross-account role in Account B.
The trust policy of `CrossAccountDynamoDBAccess` must trust the caller's identity: `arn:aws:iam::111111111111:role/TaskRole`.
The current trust policy incorrectly trusts the service principal `ecs-tasks.amazonaws.com`, which allows ECS to assume the TaskRole but does not allow the TaskRole to assume the cross-account role.
3
Define the required permissions policy in the source account (Account A).
Attach an IAM policy to `TaskRole` in Account A allowing `sts:AssumeRole` on `arn:aws:iam::222222222222:role/CrossAccountDynamoDBAccess`.
For cross-account role assumption to succeed, the source identity must be explicitly granted permission to perform the `sts:AssumeRole` action on the target role.

Key Concept

IAM Cross-Account Role Assumption with Amazon ECS Task Roles
Rate this question

Topics

IAM Policies and Roles

More questions from this topic