Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

An organization's security policy requires that all logs from Amazon Kinesis Data Firehose in Account A (456789012345456789012345) be delivered to an Amazon S3 bucket in Account B (567890123456567890123456). A SysOps administrator creates an IAM role named `FirehoseDeliveryRole` in Account A. The role's trust policy permits the Kinesis Data Firehose service principal, and its permissions policy allows writing to the target bucket. When the administrator runs the AWS CLI command to create the delivery stream and specify `FirehoseDeliveryRole`, the command returns an 'AccessDeniedException'. What is the reason for this failure?

  1. A
    The Amazon S3 bucket policy in Account B does not explicitly grant the administrator's IAM user the s3:PutObject permission.
  2. B
    The administrator's IAM user or role has not been granted sts:AssumeRole permissions on the FirehoseDeliveryRole resource.
  3. The administrator's IAM user or role lacks permission to perform the iam:PassRole action on FirehoseDeliveryRole.Answer
  4. D
    The trust policy of FirehoseDeliveryRole does not include the administrator's IAM user as a trusted principal.

Answer

The administrator's IAM user or role lacks permission to perform the iam:PassRole action on FirehoseDeliveryRole.
To associate an IAM role with an AWS service (such as Kinesis Data Firehose), the IAM identity performing the configuration must have the iam:PassRole permission for the target role resource. Without this permission, the AWS CLI command to create the delivery stream will fail with an AccessDeniedException because the user is not authorized to delegate that role to the service, even if the user has full permissions for the service itself.

Step-by-Step Solution

1
Identify the action causing the failure.
The SysOps administrator is attempting to create a Kinesis Data Firehose delivery stream and configure it to use the service role FirehoseDeliveryRole.
This determines which API actions and resource associations are being evaluated by IAM.
2
Review authorization requirements for service role delegation.
AWS requires the calling user to have the iam:PassRole permission on a role before that role can be assigned to a service.
This security measure prevents users from escalating their own privileges by assigning highly privileged roles to services.
3
Diagnose the AccessDeniedException error.
Since the administrator has firehose:* permissions and the role itself has the correct trust policy, the missing piece is authorization to pass the role itself.
The error occurs at the configuration level (creating the stream with the associated role), confirming the administrator lacks the iam:PassRole permission.

Key Concept

Delegating IAM roles to AWS services using the PassRole permission
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic