Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is running an application on an Amazon EC2 instance in Account 123456789012123456789012. The EC2 instance is associated with an IAM instance profile that uses a role named `EC2InstanceRole`. The application needs to perform temporary tasks by assuming an IAM role named `DataProcessorRole` in the same account.

The developer runs a script on the instance using the AWS SDK to assume `DataProcessorRole`, but the operation fails with an `AccessDenied` error.

The trust policy of `DataProcessorRole` is currently configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following configuration changes must the developer make to resolve this issue? (Select TWO.)

  1. Update the trust policy of `DataProcessorRole` to specify the ARN of `EC2InstanceRole` as the Principal.Answer
  2. Attach an IAM permissions policy to `EC2InstanceRole` that allows the `sts:AssumeRole` action on `arn:aws:iam::123456789012:role/DataProcessorRole`.Answer
  3. C
    Update the trust policy of `EC2InstanceRole` to define `DataProcessorRole` as a trusted Principal.
  4. D
    Attach an IAM permissions policy to `DataProcessorRole` that allows the `sts:AssumeRole` action on all resources (`*`).
  5. E
    Modify the application script to hardcode the AWS access key and secret access key of a high-privilege IAM user.

Answer

To resolve the issue, the developer must modify the trust policy of the target role (DataProcessorRole) to trust the assuming identity (EC2InstanceRole) as a principal, and attach a permissions policy to the assuming identity (EC2InstanceRole) that permits the sts:AssumeRole action on the target role's resource ARN.
For an application running on an EC2 instance to assume another IAM role, the target role's trust policy must explicitly trust the IAM identity of the calling application (the option recommending modifying the trust policy of the target role to reference the EC2 instance role ARN). Furthermore, the caller's identity-based policies must authorize it to make the call (the option recommending attaching a permissions policy allowing the assume role operation to the instance role).

Step-by-Step Solution

1
Analyze the execution caller and error condition.
The SDK script runs as the EC2InstanceRole principal. The current trust policy of DataProcessorRole only trusts the service principal 'ec2.amazonaws.com'.
When EC2 software assumes a role via SDK, the direct caller is the IAM role associated with the instance, not the EC2 service itself.
2
Correct the trust relationship of the target role.
Update the trust policy of DataProcessorRole so its Principal block contains the ARN of EC2InstanceRole.
This establishes that DataProcessorRole trusts the EC2InstanceRole principal to assume it.
3
Configure permissions for the calling identity.
Attach a permissions policy to EC2InstanceRole allowing the 'sts:AssumeRole' action on 'arn:aws:iam::123456789012:role/DataProcessorRole'.
Even when the target role trusts the caller, the caller must have client-side identity permissions authorizing it to make the AssumeRole API call.

Key Concept

Delegation via IAM AssumeRole requires permissions on both sides: the trust policy of the target role must trust the caller, and the permission policy of the calling role must allow sts:AssumeRole on the target.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic