Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an Amazon EC2 Image Builder pipeline in Account A (123456789012123456789012) to build custom machine images. The pipeline is configured to run using an IAM role named `ImageBuilderPipelineExecutionRole`. During the build process, the pipeline launches an EC2 instance that must run with an IAM instance profile associated with the IAM role `ImageBuilderBuildRole`. When the pipeline is executed, it fails during the build phase with an Access Denied error when attempting to launch the EC2 build instance. The `ImageBuilderPipelineExecutionRole` permissions policy contains permissions for `imagebuilder:*` and `ec2:*` actions but does not contain any other permissions. Which modification to the IAM policies will resolve this error?

  1. A
    Add `sts:AssumeRole` permissions for the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.
  2. B
    Modify the trust policy of `ImageBuilderBuildRole` to allow the `ImageBuilderPipelineExecutionRole` to perform the `sts:AssumeRole` action.
  3. Add `iam:PassRole` permissions for the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.Answer
  4. D
    Attach a policy to `ImageBuilderBuildRole` allowing it to perform the `sts:AssumeRole` action on the `ImageBuilderPipelineExecutionRole` resource.

Answer

Add `iam:PassRole` permissions for the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.
To launch an Amazon EC2 instance with an IAM role associated, the principal launching the instance (in this case, the EC2 Image Builder pipeline execution role) must have `iam:PassRole` permissions on the role being passed to the instance (`ImageBuilderBuildRole`). This allows the pipeline to safely delegate the role to the EC2 service for the build instance.

Step-by-Step Solution

1
Identify the failing action.
The EC2 Image Builder pipeline fails during the build phase while attempting to launch an EC2 instance associated with the `ImageBuilderBuildRole` role.
This indicates that the identity launching the instance (the pipeline execution role) lacks the authority to delegate the target role to the EC2 instance.
2
Determine the required IAM permission for role delegation.
The `iam:PassRole` permission is required.
When an AWS service or service role launches a resource with an IAM role attached, the calling principal must have the explicit permission to pass that role to the service.
3
Update the execution role policy.
Add `iam:PassRole` on the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.
This grants the pipeline execution role the necessary permissions to successfully pass the build role to the EC2 service during the instance launch.

Key Concept

IAM Role Delegation and the PassRole Permission
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic