Examkin

Question

Difficulty: EasyIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is creating an Amazon Kinesis Data Firehose delivery stream that must write log data to an Amazon S3 bucket. The administrator has already created an IAM role with the necessary S3 permissions and a trust policy that allows Kinesis Firehose to assume the role. However, when the administrator attempts to create the delivery stream using this role, the operation fails with an authorization error.

Which IAM permission must be granted to the SysOps administrator's IAM policy to resolve this issue?

  1. A
    iam:AttachRolePolicy
  2. B
    sts:AssumeRole
  3. iam:PassRoleAnswer
  4. D
    sts:GetSessionToken

Answer

The permission that allows the administrator to pass the IAM role to the AWS service is iam:PassRole.
The correct answer is the permission that allows an administrator to pass an IAM role to an AWS service (such as Kinesis Data Firehose) so that the service can assume the role and perform actions on their behalf. The iam:PassRole permission must be explicitly granted in the administrator's IAM policy for this operation to succeed.

Step-by-Step Solution

1
Identify the action causing the failure.
The SysOps administrator is attempting to associate an IAM role with Amazon Kinesis Data Firehose, which is a role delegation action.
When configuring AWS services to act on behalf of a user, the user must have permission to pass the role to the service.
2
Determine the required permission for role delegation.
The required permission is iam:PassRole, which must be added to the administrator's IAM policy.
This permission prevents users from passing highly privileged roles to services they should not configure.

Key Concept

Delegating IAM roles to AWS services requires the iam:PassRole permission on the user or role performing the configuration.
Estimated Time:45s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic