Examkin

Question

Difficulty: MediumAuto Scaling and Elasticity

A SysOps administrator is configuring an Amazon EC2 Auto Scaling group (ASG) to launch instances using a new launch template. The launch template specifies an IAM instance profile with an associated IAM role for the instances. When the ASG attempts to launch instances to meet the desired capacity, all launch attempts fail with the status message: "You are not authorized to perform this operation." The administrator verified that the administrator's IAM identity has the necessary permissions to create the ASG and the launch template. Which configuration change will resolve the launch failures?

  1. A
    Modify the trust policy of the instance profile's IAM role to allow the Auto Scaling service principal (autoscaling.amazonaws.com) to perform the sts:AssumeRole action.
  2. B
    Create a custom service-linked role for the Auto Scaling group and attach a policy that grants the sts:AssumeRole permission to the Auto Scaling group.
  3. Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.Answer
  4. D
    Enable detailed monitoring in the launch template to authorize the Auto Scaling group to send launch status metrics to Amazon CloudWatch.

Answer

Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.
The correct answer is to attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role. AWS requires that any identity configuring an AWS service to act on its behalf must have permission to pass the associated role. Without this permission, the EC2 service cannot associate the IAM role with the newly launched instances, resulting in an authorization error.

Step-by-Step Solution

1
Analyze the error message 'You are not authorized to perform this operation' in the ASG activity history.
Determine that the failure is caused by an IAM authorization issue when attempting to launch instances with an associated IAM role.
The launch template includes an IAM instance profile, meaning the launching entity must have permission to pass this role to EC2.
2
Identify the required IAM action for passing roles to AWS services.
The iam:PassRole action is identified as the required permission on the calling identity's policy.
AWS enforces iam:PassRole to prevent users from escalating their privileges by passing roles with greater permissions than they have.
3
Add the iam:PassRole permission targeting the specific IAM role ARN to the administrator's IAM policy.
The ASG successfully passes the IAM role to EC2, allowing instances to launch without authorization errors.
This completes the required permission chain for the ASG to launch instances with the specified IAM role.

Key Concept

IAM PassRole requirement for EC2 Auto Scaling launches
Rate this question

Topics

Auto Scaling and Elasticity

More questions from this topic