Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring AWS Config in a new AWS account. The administrator wants to use the AWS CLI to create a configuration recorder that uses a custom, pre-created IAM role named `ConfigRecorderRole`. However, when attempting to run the CLI command, the administrator receives an Access Denied error.

Which of the following actions are required to resolve this issue and successfully create the configuration recorder? (Select TWO.)

  1. Configure the trust policy of `ConfigRecorderRole` to allow the `config.amazonaws.com` service principal to perform the `sts:AssumeRole` action.Answer
  2. Attach an IAM policy to the SysOps administrator's IAM identity that grants the `iam:PassRole` permission for the Amazon Resource Name (ARN) of `ConfigRecorderRole`.Answer
  3. C
    Attach an IAM policy to the SysOps administrator's IAM identity that grants the `sts:AssumeRole` permission for the Amazon Resource Name (ARN) of `ConfigRecorderRole`.
  4. D
    Add a service control policy (SCP) to the organization's root that explicitly allows the `config.amazonaws.com` service principal to assume the `ConfigRecorderRole`.
  5. E
    Configure the Key Management Service (KMS) key policy associated with the AWS Config S3 bucket to grant the `iam:PassRole` permission to the configuration recorder.

Answer

To successfully configure the AWS Config recorder, the administrator must configure the trust policy of the IAM role to allow the AWS Config service principal to perform the assume-role action, and attach an IAM policy to their own IAM identity that grants the permission to pass the IAM role.
The correct options are the action to configure the trust policy of the IAM role to trust the AWS Config service principal and the action to attach an IAM policy to the administrator's identity granting the pass-role permission. These actions address the two independent permission boundaries required for service role assignment: trusting the service to assume the role, and authorizing the user to delegate the role.

Step-by-Step Solution

1
Analyze the Access Denied error context when assigning an IAM role to an AWS service.
Identify that the operation involves delegation of permissions where a service (AWS Config) needs to act on behalf of the account using a specific IAM role.
This establishes that both service trust (AssumeRole) and user authorization to delegate the role (PassRole) are required.
2
Verify and update the trust relationship of the IAM role.
Ensure that the trust policy explicitly allows the `config.amazonaws.com` service principal to call `sts:AssumeRole`.
Without this trust relationship, the service principal cannot assume the role, regardless of user permissions.
3
Ensure the administrator has delegation permissions.
Grant the `iam:PassRole` permission for the target role's ARN to the administrator's IAM identity.
This prevents users from passing highly privileged roles to services without explicit authorization.

Key Concept

Configuring service trust relationships and role delegation permissions for AWS services.
Estimated Time:1m 30s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic