Examkin

Question

Difficulty: Very hardAWS Elastic Disaster Recovery

A SysOps Administrator is implementing a hybrid disaster recovery strategy using AWS Elastic Disaster Recovery (AWS DRS) to replicate on-premises database servers to AWS. The AWS Replication Agent is successfully installed and the replication status in the AWS DRS console is 'Healthy'. The administrator modifies the default EC2 Launch Template in the AWS DRS console to specify that recovered instances must launch with a predefined IAM instance profile named 'DatabaseRecoveryProfile' to grant database processes access to specific Amazon S3 buckets. When the administrator initiates a recovery drill in the AWS DRS console, the launch job fails during the EC2 instantiation phase. What is the most likely cause of this failure?

  1. A
    The on-premises AWS Replication Agent credentials lack the iam:PassRole permission, preventing the agent from attaching the DatabaseRecoveryProfile to the target instances during the block replication phase.
  2. The IAM policy of the administrator initiating the recovery drill does not include the iam:PassRole permission for the role associated with the DatabaseRecoveryProfile instance profile.Answer
  3. C
    The trust policy of the DatabaseRecoveryProfile role does not allow the Elastic Disaster Recovery service (drs.amazonaws.com) to assume the role on behalf of the administrator.
  4. D
    The Route 53 failover routing policy associated with the application endpoint fails to detect the recovery drill instance because it lacks a health check mapping, aborting the DRS launch sequence.

Answer

The IAM policy of the administrator initiating the recovery drill does not include the iam:PassRole permission for the role associated with the DatabaseRecoveryProfile instance profile.
To launch an EC2 instance with an associated IAM role, the user or role launching the instance (in this case, the SysOps Administrator performing the recovery drill) must have the iam:PassRole permission for that role. Without it, the EC2 service will prevent the launch because the user is not authorized to delegate permissions to the instance.

Step-by-Step Solution

1
Identify the stage at which the recovery drill failed.
The failure occurred during the EC2 instantiation phase, indicating a provisioning or launch configuration error rather than a replication issue.
Isolating the stage helps narrow down the failure to EC2 launch permissions or templates rather than agent network settings.
2
Review the configuration changes made to the default EC2 Launch Template.
An IAM instance profile ('DatabaseRecoveryProfile') was specified to be attached to the recovered EC2 instances.
Attaching an IAM role during EC2 instantiation introduces security policy dependencies, specifically the delegation of permissions.
3
Evaluate the IAM permissions required to launch an EC2 instance with a role attached.
The calling identity must have 'iam:PassRole' permission to pass the role to the EC2 service.
AWS prevents unauthorized users from elevating their privileges by passing arbitrary roles to EC2 instances.
4
Diagnose the administrator's permission set.
The administrator's IAM policy lacks 'iam:PassRole' for the specified role, resulting in an unauthorized error that fails the launch job.
Verifying the IAM user policies of the administrator is the correct resolution step.

Key Concept

AWS Elastic Disaster Recovery EC2 Launch Template IAM PassRole requirement
Rate this question

Topics

AWS Elastic Disaster Recovery

More questions from this topic