Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring a scheduled backup plan using AWS Backup. The backup plan must run under a custom IAM service role. The administrator creates the service role with the necessary permissions policy but receives an 'Access Denied' error when attempting to assign the role to the backup selection in the console. Which actions must the administrator perform to successfully assign the role and ensure the backup plan executes? (Select TWO.)

  1. Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the custom service role.Answer
  2. Update the trust policy of the custom service role to allow backup.amazonaws.com to perform the sts:AssumeRole action.Answer
  3. C
    Attach an IAM policy to the administrator's IAM identity that grants the sts:AssumeRole permission for the custom service role.
  4. D
    Update the trust policy of the custom service role to allow backup.amazonaws.com to perform the iam:PassRole action.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the custom service role, and update the trust policy of the custom service role to allow backup.amazonaws.com to perform the sts:AssumeRole action.
To successfully configure and run the backup plan under a custom service role, two conditions must be met: First, the administrator must have permission to pass the role to AWS Backup, which is configured via the iam:PassRole action. Second, the service role must trust the AWS Backup service to assume it, which is configured by granting the sts:AssumeRole action to backup.amazonaws.com in the role's trust policy.

Step-by-Step Solution

1
Identify the two separate permissions required when configuring an AWS service role: the permission for the administrator to associate the role, and the permission for the service to assume the role.
Determined that the administrator needs iam:PassRole and the service needs sts:AssumeRole.
AWS security requires explicit permission delegation so that users cannot pass roles with elevated privileges that they themselves do not possess, and roles must explicitly trust services that assume them.
2
Configure the administrator's IAM identity policy.
Added a statement allowing iam:PassRole on the custom service role resource.
This allows the administrator to delegate (pass) the role to AWS Backup.
3
Configure the service role's trust policy.
Added a trust relationship statement allowing the backup.amazonaws.com principal to perform sts:AssumeRole.
This allows AWS Backup to assume the role's identity at runtime.

Key Concept

Delegating permissions to AWS services using iam:PassRole and configuring role trust policies with sts:AssumeRole.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic