Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

An application running on an Amazon EC2 instance in Account A (111122223333111122223333) must write logs to an Amazon CloudWatch Logs log group in Account B (444455556666444455556666). A SysOps administrator is configuring the application to programmatically assume an IAM role named `CrossAccountLogWriterRole` in Account B to perform this action.

Which of the following configuration steps are required to establish this cross-account access? (Select TWO.)

  1. Attach an IAM policy to the EC2 instance's IAM role in Account A that allows the `sts:AssumeRole` action on the `CrossAccountLogWriterRole` ARN in Account B.Answer
  2. Modify the trust policy of `CrossAccountLogWriterRole` in Account B to allow the EC2 instance's IAM role in Account A to perform the `sts:AssumeRole` action.Answer
  3. C
    Attach an IAM policy to the EC2 instance's IAM role in Account A that allows the `iam:PassRole` action on the `CrossAccountLogWriterRole` ARN in Account B.
  4. D
    Modify the trust policy of `CrossAccountLogWriterRole` in Account B to allow the EC2 instance's IAM role in Account A to perform the `iam:PassRole` action.

Answer

To configure cross-account access, the administrator must attach an IAM policy to the EC2 instance's IAM role in Account A to allow the sts:AssumeRole action on the target role, and modify the trust policy of the CrossAccountLogWriterRole in Account B to allow the EC2 instance's IAM role to perform the sts:AssumeRole action.
Establishing cross-account delegation requires configuring both sides of the trust relationship. First, the calling identity (the EC2 instance's IAM role in Account A) must have an IAM policy that permits the sts:AssumeRole action on the destination role's ARN in Account B. Second, the destination role (CrossAccountLogWriterRole in Account B) must have a trust policy that permits the EC2 instance's IAM role to assume it.

Step-by-Step Solution

1
Configure the permission policy in the source account.
The EC2 instance's IAM role in Account A is granted permissions to perform the sts:AssumeRole operation targeting the ARN of the role in Account B.
Before an IAM identity can assume another role, it must be explicitly allowed to perform the sts:AssumeRole action on the target resource.
2
Configure the trust relationship in the target account.
The CrossAccountLogWriterRole trust policy in Account B is updated to list the ARN of the EC2 instance's IAM role from Account A as a trusted Principal.
An IAM role must explicitly define who is trusted to assume it; without this trust relationship, assume role requests will be denied.

Key Concept

Cross-account delegation requires a two-way handshake: the source principal's permission policy must allow calling sts:AssumeRole on the target role, and the target role's trust policy must trust the source principal.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic