Examkin

Question

Difficulty: MediumVPC Flow Logs and Network Monitoring

An organization is experiencing high data transfer costs through a NAT gateway. A SysOps Administrator attempts to create a VPC Flow Log at the subnet level to capture traffic details and deliver them to an Amazon CloudWatch Logs log group. Although the administrator has administrative permissions for Amazon EC2 and CloudWatch Logs, and has created a dedicated service role with the appropriate trust policy for delivery.logs.amazonaws.com, the creation of the flow log fails with an 'Access Denied' error. Which of the following actions should the administrator take to resolve this issue?

  1. A
    Modify the trust policy of the dedicated service role to allow the administrator's IAM identity to assume the role via the sts:AssumeRole API operation.
  2. Add an IAM policy to the administrator's identity that grants the iam:PassRole permission targeting the ARN of the dedicated service role.Answer
  3. C
    Ensure that the destination CloudWatch Logs log group does not have a retention policy configured to prevent delivery failure.
  4. D
    Configure a CloudWatch alarm for NAT gateway active connections and link it to an EventBridge rule that executes the flow log creation.

Answer

Add an IAM policy to the administrator's identity that grants the iam:PassRole permission targeting the ARN of the dedicated service role.
The correct action is to add an IAM policy to the administrator's identity that grants the iam:PassRole permission targeting the ARN of the dedicated service role. This is required because when an AWS resource needs a role to perform actions on your behalf (such as VPC Flow Logs writing to CloudWatch Logs), the user configuring the resource must have permission to pass that role to the service.

Step-by-Step Solution

1
Analyze the IAM permission requirements for creating VPC Flow Logs that publish to Amazon CloudWatch Logs.
Identify that the administrator must pass the delivery IAM role to the VPC Flow Logs service.
VPC Flow Logs requires permission to write logs to CloudWatch Logs using a service role, which must be passed by the user creating the flow log.
2
Determine why the 'Access Denied' error occurs despite having EC2 and CloudWatch administrative access.
Realize that administrative access does not implicitly grant permission to pass roles unless explicitly allowed or using full administrator access with iam:*.
The iam:PassRole permission is a security boundary that must be explicitly granted to the identity creating the resource.
3
Select the correct IAM policy adjustment to allow role passing.
Attach an IAM policy granting iam:PassRole for the service role's ARN to the administrator's IAM identity.
This allows the administrator to successfully delegate the log delivery role to the VPC Flow Logs service, resolving the 'Access Denied' error.

Key Concept

IAM PassRole permissions for VPC Flow Logs delivery to CloudWatch Logs
Estimated Time:1m 30s
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic