Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is configuring a GitHub Actions workflow to deploy resources to an AWS account. To follow security best practices, the developer avoids using long-lived AWS credentials. Instead, they configure an OpenID Connect (OIDC) identity provider in IAM and create an IAM role named GitHubDeployRole to be assumed by the workflow.

The developer starts writing the following trust policy for the role, leaving two placeholders:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "________",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
"________": "repo:my-organization/my-repo:ref:refs/heads/main"
}
}
}
]
}

Which two values must the developer use to replace the placeholders to establish this trust relationship securely? (Select TWO.)

  1. Set the Action element to sts:AssumeRoleWithWebIdentityAnswer
  2. Set the second condition key to token.actions.githubusercontent.com:subAnswer
  3. C
    Set the Action element to sts:AssumeRole
  4. D
    Set the second condition key to aws:PrincipalArn
  5. E
    Set the Action element to sts:AssumeRoleWithSAML

Answer

Setting the Action element to sts:AssumeRoleWithWebIdentity and setting the second condition key to token.actions.githubusercontent.com:sub.
To configure the OIDC trust relationship, the role must trust the OIDC provider and allow the action stating sts:AssumeRoleWithWebIdentity. To secure the trust relationship and prevent any GitHub workflow from assuming the role, the policy must use the condition key specifying token.actions.githubusercontent.com:sub to restrict access to only the specific organization, repository, and branch.

Step-by-Step Solution

1
Identify the authentication mechanism
OIDC federation via GitHub Actions
Since the pipeline uses OpenID Connect (OIDC) rather than SAML or standard AWS user credentials, we must use the STS action designed for web identity tokens.
2
Select the correct STS assume role action
sts:AssumeRoleWithWebIdentity
OIDC identity providers authenticate and request temporary security credentials using the AssumeRoleWithWebIdentity API call.
3
Identify the condition key to restrict repository scope
token.actions.githubusercontent.com:sub
To prevent unauthorized repositories from assuming the IAM role, the trust policy must assert a condition against the sub (subject) claim of the incoming token, which contains the repository organization, name, and branch reference.

Key Concept

IAM trust policies for OpenID Connect (OIDC) federation.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic