Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is attempting to create an AWS Step Functions state machine using the AWS CLI. The state machine needs to use an existing IAM execution role named StepFunctionsExecutionRole to perform its tasks. When running the creation command, the administrator receives an Access Denied error, despite having full administrator access to AWS Step Functions. To resolve this issue, which permission must be attached to the administrator's IAM user policy?

  1. A
    An IAM policy statement that allows the sts:AssumeRole action on the StepFunctionsExecutionRole ARN.
  2. B
    An IAM policy statement that allows the iam:PassRole action on the states.amazonaws.com service principal.
  3. An IAM policy statement that allows the iam:PassRole action on the StepFunctionsExecutionRole ARN.Answer
  4. D
    An IAM policy statement that allows the sts:AssumeRole action on the states.amazonaws.com service principal.

Answer

The administrator's IAM user policy must include a statement that allows the iam:PassRole action on the StepFunctionsExecutionRole ARN.
To configure an AWS service to act on your behalf using an IAM role, your IAM identity must have permission to pass that role to the service. This is achieved by granting the iam:PassRole permission on the target role's Amazon Resource Name (ARN) in your user or group policy. Since the administrator is creating a state machine that runs under the StepFunctionsExecutionRole, the administrator must be allowed to pass this specific role to the Step Functions service.

Step-by-Step Solution

1
Analyze the error message and context.
The administrator is attempting to associate an existing IAM role with an AWS service (Step Functions) but is blocked by an Access Denied error despite having full Step Functions administrative access.
Associating a role with a service requires explicit permission to delegate or pass that role to the service.
2
Identify the correct IAM permission required to associate a role with a service.
The iam:PassRole permission is required on the IAM user/role attempting the configuration.
AWS prevents users from passing roles with higher privileges than their own unless they are explicitly authorized via iam:PassRole.
3
Determine the target resource and Action for the policy statement.
The Action must be iam:PassRole, and the Resource must be the ARN of the StepFunctionsExecutionRole.
This complies with the principle of least privilege by only allowing the administrator to pass the specific role required for the state machine.

Key Concept

IAM Role Delegation and the PassRole Permission
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic