Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an AWS Systems Manager (SSM) Automation runbook to patch Amazon EC2 instances. The runbook must launch a temporary EC2 instance, associate a pre-configured IAM role named `PatchingInstanceRole` with the instance, run patching scripts, and then terminate the instance. The administrator runs the SSM Automation using an automation service role named `AutomationServiceRole`. The trust relationship of `AutomationServiceRole` is correctly configured to trust the `ssm.amazonaws.com` service principal. However, when the runbook attempts to launch the temporary EC2 instance with the `PatchingInstanceRole`, the execution fails with an 'Access Denied' error. Which of the following modifications will resolve this issue?

  1. Attach an IAM policy to the `AutomationServiceRole` that grants `iam:PassRole` permissions for the `PatchingInstanceRole` resource.Answer
  2. B
    Modify the trust relationship of the `PatchingInstanceRole` to allow the `AutomationServiceRole` to perform the `sts:AssumeRole` action.
  3. C
    Add the `iam:PassRole` permission to the identity-based policy of the `PatchingInstanceRole` to allow it to pass itself to Amazon EC2.
  4. D
    Modify the trust policy of the `AutomationServiceRole` to trust `ec2.amazonaws.com` in addition to `ssm.amazonaws.com`.

Answer

Attach an IAM policy to the `AutomationServiceRole` that grants `iam:PassRole` permissions for the `PatchingInstanceRole` resource.
To associate an IAM role with an EC2 instance, the entity initiating the action (in this case, the `AutomationServiceRole` running the SSM Automation) must be authorized to pass that role to the EC2 service. This authorization is granted by adding the `iam:PassRole` action to the identity-based policy of the caller (`AutomationServiceRole`), referencing the target role (`PatchingInstanceRole`) as the resource. Without this permission, the caller cannot assign the role to the newly created instance, resulting in an 'Access Denied' error.

Step-by-Step Solution

1
Identify the service performing the operation.
The AWS Systems Manager service role (`AutomationServiceRole`) is attempting to launch an EC2 instance with a specific IAM role (`PatchingInstanceRole`).
To fix permission issues, we must determine which identity is initiating the API call and needs to be granted permissions.
2
Determine the required permission for passing roles to AWS services.
The `iam:PassRole` permission is required for any user or service role that associates an IAM role with an AWS resource.
AWS prevents privilege escalation by requiring that a calling principal explicitly has permission to pass a specific role to a service.
3
Attach the policy containing the `iam:PassRole` action to the caller.
An identity-based policy is attached to the `AutomationServiceRole` allowing the `iam:PassRole` action, specifying the `PatchingInstanceRole` Amazon Resource Name (ARN) as the resource.
This grants the SSM service role the necessary authorization to successfully pass the patching role to the EC2 service during instance creation.

Key Concept

To configure an AWS service to act on your behalf or to pass an IAM role to a resource (such as an EC2 instance profile), the calling identity must be granted `iam:PassRole` permissions for that specific target role.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic