Examkin

Question

Difficulty: HardAWS Budgets and Cost Alerts

A SysOps administrator wants to configure automated cost controls for an AWS account used for experimental testing. The administrator needs to prevent developers from launching any new resources as soon as the forecasted monthly spend for the account exceeds $1500. The administrator decides to use AWS Budgets Actions to attach a restrictive IAM policy to the developers' IAM group. Which set of actions is required to successfully implement this configuration?

  1. Create a budget in AWS Budgets with a forecasted spend threshold of $1500. Create an IAM role with a trust policy allowing budgets.amazonaws.com to assume the role, and grant the role permissions to attach IAM policies. Grant the administrator's IAM identity iam:PassRole permissions for the role, and configure the budget action using this role to apply the restrictive IAM policy to the developers' group.Answer
  2. B
    Create a budget in AWS Budgets with a forecasted spend threshold of $1500. Create an IAM role with a trust policy allowing budgets.amazonaws.com to assume the role. Attach an IAM policy to the role that grants it iam:PassRole permissions on itself, and configure the budget action to apply the restrictive IAM policy to the developers' group.
  3. C
    Create an AWS Cost Anomaly Detection monitor with a threshold of $1500. Configure an anomaly action that uses an IAM role with permissions to attach the restrictive IAM policy to the developers' group when forecasted costs exceed the limit.
  4. D
    Create an Amazon CloudWatch billing alarm for forecasted charges exceeding $1500. Configure the alarm to send a notification to an Amazon SNS topic, and subscribe the developers' IAM group to the SNS topic to automatically apply the policy.

Answer

Create a budget in AWS Budgets with a forecasted spend threshold of $1500. Create an IAM role with a trust policy allowing budgets.amazonaws.com to assume the role, and grant the role permissions to attach IAM policies. Grant the administrator's IAM identity iam:PassRole permissions for the role, and configure the budget action using this role to apply the restrictive IAM policy to the developers' group.
The correct configuration uses AWS Budgets Actions to natively attach an IAM policy to the developers' group. This requires an execution role trusted by budgets.amazonaws.com with permissions to manage IAM policies. Crucially, the administrator setting up the budget action must possess the iam:PassRole permission on the execution role, ensuring secure delegation of authority.

Step-by-Step Solution

1
Create the execution IAM role for AWS Budgets.
An IAM role is created with a trust policy allowing the service principal budgets.amazonaws.com to assume it, along with a permissions policy allowing iam:AttachGroupPolicy.
AWS Budgets needs to assume this role to perform the action of attaching the policy to the developers' group.
2
Grant the administrator the iam:PassRole permission.
The administrator's IAM policy is updated to allow passing the newly created execution role to the AWS Budgets service.
Without iam:PassRole on the administrator's identity, AWS Budgets will fail to register the action because it cannot verify authorization to delegate the role.
3
Configure the budget and the forecasted cost threshold action.
A budget is established with a $1500 limit, and a budget action is set to trigger when forecasted costs reach 100% of the budget.
This establishes the trigger point for the automated enforcement policy using native AWS Budgets functionality.

Key Concept

Configuring AWS Budgets Actions with the appropriate IAM trust policies and PassRole permissions.
Rate this question

Topics

AWS Budgets and Cost Alerts

More questions from this topic