Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring an AWS Step Functions state machine that will write logs to Amazon CloudWatch Logs, write data directly to an Amazon DynamoDB table, and send notifications to an Amazon SNS topic. The developer is creating an IAM role for the state machine to grant the necessary permissions.

Which two configuration steps must the developer perform to successfully and securely configure this IAM role? (Select two.)

  1. Configure the trust policy of the IAM role to allow the states.amazonaws.com service principal to assume the role.Answer
  2. Attach a permissions policy to the IAM role that grants permissions for dynamodb:PutItem, sns:Publish, and CloudWatch Logs write actions on the specific target resource ARNs.Answer
  3. C
    Configure the trust policy of the IAM role to allow the dynamodb.amazonaws.com and sns.amazonaws.com service principals to assume the role.
  4. D
    Attach a permissions policy to the IAM role that grants the sts:AssumeRole permission to the DynamoDB and SNS service principals.
  5. E
    Store permanent AWS access keys in the Step Functions state machine definition to authenticate API calls to DynamoDB and SNS.

Answer

Configure the trust policy of the IAM role to trust the Step Functions service principal (states.amazonaws.com) and attach a permissions policy that grants access to the specific DynamoDB table, SNS topic, and CloudWatch Logs target resources.
To successfully run the Step Functions state machine with the necessary permissions, two parts of the IAM role configuration are required. First, the trust policy must trust the Step Functions service principal ('states.amazonaws.com') to allow it to assume the role. Second, the permissions policy attached to the role must grant the required access to the target DynamoDB table, SNS topic, and CloudWatch Logs resource ARNs.

Step-by-Step Solution

1
Identify the service principal that needs to assume the role.
The AWS Step Functions service principal (states.amazonaws.com) requires permission to assume the execution role.
This configuration belongs in the role's trust policy so Step Functions can obtain temporary credentials using the Security Token Service (STS).
2
Determine the necessary permissions for the application workflow.
The state machine needs permissions to put items in DynamoDB, publish to SNS, and write logs to CloudWatch Logs.
These API operations must be explicitly allowed by attaching an identity-based permissions policy to the execution role.
3
Apply the principle of least privilege.
Limit the permissions policy resources to specific target ARNs (DynamoDB table, SNS topic, and CloudWatch log group) rather than using wildcards.
This secures the environment by preventing the state machine from accessing unintended resources.

Key Concept

IAM execution roles consist of a trust policy (defining which principal can assume the role) and a permissions policy (defining what actions that role can perform on which resources).
Estimated Time:1m 30s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic