Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is setting up an application on an on-premises server that must archive daily transaction logs to a private Amazon S3 bucket. To implement this securely without storing long-term credentials on the server, the developer creates an IAM User named `archive-agent` in the AWS account `111122223333` and an IAM Role named `S3UploaderRole` that has permissions to write to the S3 bucket. The application will authenticate as `archive-agent` using short-term configurations and then assume `S3UploaderRole` to perform the S3 uploads.

Which two configuration policies are required to establish this role-assumption trust relationship and grant the necessary permissions? (Select two.)

  1. A trust policy attached to S3UploaderRole that allows the archive-agent user to assume the role:

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::111122223333:user/archive-agent"
    },
    "Action": "sts:AssumeRole"
    }
    ]
    }
    Answer
  2. A permissions policy attached to the archive-agent user that permits calling sts:AssumeRole on the role:

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::111122223333:role/S3UploaderRole"
    }
    ]
    }
    Answer
  3. C
    A trust policy attached to S3UploaderRole containing S3 permissions directly:

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::111122223333:user/archive-agent"
    },
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::company-logs-bucket/*"
    }
    ]
    }
  4. D
    A permissions policy attached to S3UploaderRole that references the user as a resource:

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::111122223333:user/archive-agent"
    }
    ]
    }
  5. E
    A local credentials file containing static credentials for the AWS Account Root User to bypass role assumption:

    {
    "aws_access_key_id": "AKIAIOSFODNN7EXAMPLE",
    "aws_secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    }

Answer

To establish the trust relationship and grant permissions, the developer must attach a trust policy to the S3UploaderRole that lists the archive-agent user as the trusted principal allowed to perform the sts:AssumeRole action, and attach an IAM permissions policy to the archive-agent user that permits calling sts:AssumeRole on the role's Amazon Resource Name (ARN).
Role assumption is a two-way handshake. The trust policy attached to the S3UploaderRole must declare the archive-agent IAM User as a trusted principal that is permitted to execute the sts:AssumeRole action. Simultaneously, the archive-agent user must possess a permissions policy that explicitly permits it to perform the sts:AssumeRole action against the target role's ARN. This combination ensures that the user is authorized to request the role and the role is authorized to trust the user.

Step-by-Step Solution

1
Configure the trust policy on the destination IAM Role.
The target role (S3UploaderRole) allows sts:AssumeRole requests originating from the archive-agent IAM User principal.
An IAM Role's trust policy establishes which trusted identities (principals) are authorized to assume it.
2
Configure the permissions policy on the source IAM User.
The archive-agent user has explicit permission to call sts:AssumeRole on the ARN of the S3UploaderRole.
By default, IAM users do not have permissions to call STS AssumeRole; this must be explicitly granted in their permissions policy.

Key Concept

Role assumption requires permissions configured on both sides: a trust policy on the role defining who can assume it, and an identity permissions policy on the user permitting the assume role action.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic