Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator has the following IAM policy attached to their IAM user:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"backup:CreateBackupSelection",
"backup:GetBackupPlan"
],
"Resource": "*"
}
]
}

The administrator is attempting to configure a new backup selection to assign a custom IAM role (`arn:aws:iam::111122223333:role/CustomBackupRole`) to a backup plan. The custom IAM role's trust policy allows `backup.amazonaws.com` to assume it. When trying to save the selection, the administrator receives an Access Denied error.

Which policy update is required to resolve this error?

  1. A
    Add a statement to the administrator's IAM policy that allows the sts:AssumeRole action on the CustomBackupRole resource.
  2. B
    Update the CustomBackupRole's trust policy to grant the administrator's IAM identity permission to perform the sts:AssumeRole action.
  3. Add a statement to the administrator's IAM policy that allows the iam:PassRole action targeting the CustomBackupRole ARN as the resource.Answer
  4. D
    Add a Service Control Policy (SCP) at the root level of the organization that allows sts:AssumeRole for the backup.amazonaws.com service principal.

Answer

Add a statement to the administrator's IAM policy that allows the iam:PassRole action targeting the CustomBackupRole ARN as the resource.
To configure an AWS service (such as AWS Backup) to run tasks using a specific IAM role, the user performing the configuration must have permission to pass that role to the service. This is controlled by the iam:PassRole permission, which must be allowed in the administrator's IAM policy targeting the ARN of the custom backup IAM role. This prevents unauthorized users from passing highly privileged roles to services.

Step-by-Step Solution

1
Analyze the error message and the current permission set of the administrator.
The administrator has permissions to create a backup selection, but the operation fails when attempting to pass the CustomBackupRole to the AWS Backup service.
AWS Backup must run backup tasks using the permissions of the specified custom role. To delegate this role to the service, the user setting up the backup selection must have explicit permission to pass the role.
2
Differentiate between role assumption and role passing.
Identify that sts:AssumeRole is for obtaining temporary security credentials directly, whereas iam:PassRole is required to configure an AWS service to act on behalf of the user using a specific role.
Choosing sts:AssumeRole is a common configuration error; it does not authorize the delegation of permissions to the AWS Backup service principal.
3
Formulate the correct policy statement to resolve the error.
Add a statement to the administrator's policy allowing the iam:PassRole action targeting the specific role ARN.
This grants the administrator the minimum required privilege to pass only the specific role needed for AWS Backup operations, satisfying security best practices.

Key Concept

IAM Role Delegation and the iam:PassRole Permission
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic