Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is setting up a nightly automation task using AWS Systems Manager (SSM) Maintenance Windows to run a command on a fleet of Amazon EC2 instances. The maintenance window is configured to use a custom service role named MaintenanceWindowServiceRole to run the task. The administrator has attached an IAM policy to their own IAM user account that contains the following statement:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:RegisterTaskWithMaintenanceWindow",
"ssm:UpdateMaintenanceWindowTask"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::111122223333:role/MaintenanceWindowServiceRole"
}
]
}

When the administrator attempts to register the task with the maintenance window specifying MaintenanceWindowServiceRole as the service role, the operation fails with an 'Access Denied' error. The trust policy of MaintenanceWindowServiceRole correctly trusts ssm.amazonaws.com. What should the administrator do to resolve this issue?

  1. Replace the sts:AssumeRole permission in the administrator's IAM policy with the iam:PassRole permission for the MaintenanceWindowServiceRole.Answer
  2. B
    Add sts:AssumeRole to the trust policy of the administrator's IAM user.
  3. C
    Modify the trust policy of MaintenanceWindowServiceRole to trust the administrator's IAM user ARN instead of the Systems Manager service principal.
  4. D
    Add the iam:PassRole action to the trust policy of MaintenanceWindowServiceRole to allow the Systems Manager service to pass the role.

Answer

Replace the sts:AssumeRole permission in the administrator's IAM policy with the iam:PassRole permission for the MaintenanceWindowServiceRole.
To associate an IAM service role with an AWS service task, the user executing the operation must have permission to pass that role to the service. This is achieved by granting the iam:PassRole permission in the user's IAM policy, targeting the ARN of the service role. The service then uses its trust policy containing sts:AssumeRole to assume the role at execution time.

Step-by-Step Solution

1
Analyze the error message and the current IAM policies.
Identify that the Access Denied error occurs during task registration because the administrator is attempting to associate an IAM service role with Systems Manager.
When configuring AWS services to act on behalf of a user, the user must have permission to pass the service role to the service.
2
Evaluate the current permissions in the administrator's user policy.
Observe that the policy grants sts:AssumeRole instead of iam:PassRole for the service role.
The administrator confused direct role assumption (sts:AssumeRole) with passing the role to a service (iam:PassRole).
3
Update the administrator's IAM policy to grant the correct permission.
Replace the sts:AssumeRole action with iam:PassRole for the target role ARN.
This allows the administrator to successfully delegate the role to Systems Manager, which then uses its own service trust relationship to assume the role at execution time.

Key Concept

Delegating permissions to AWS services using the iam:PassRole permission and service trust relationships.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic