A SysOps administrator is configuring an AWS Systems Manager Automation workflow. The workflow requires a custom IAM role to perform actions on AWS resources. The administrator has already created the IAM role with the necessary permissions policies.
Which combination of actions is required to allow the Systems Manager Automation workflow to run successfully using this role? (Select TWO.)
- Configure the trust policy of the custom IAM role to allow the ssm.amazonaws.com service principal to perform the sts:AssumeRole actionAnswer
- Attach an IAM permissions policy to the administrator's IAM identity that grants the iam:PassRole permission for the custom IAM roleAnswer
- CConfigure the trust policy of the custom IAM role to allow the administrator's IAM identity to perform the iam:PassRole action
- DAttach an IAM permissions policy to the custom IAM role that grants the sts:AssumeRole permission to the ssm.amazonaws.com service principal
Answer
The correct actions are to configure the trust policy of the custom IAM role to allow the Systems Manager service principal to assume the role, and to attach an IAM permissions policy to the administrator's IAM identity that grants the iam:PassRole permission.
To delegate permissions to an AWS service like Systems Manager Automation, the service must be allowed to assume the custom role, which is configured in the role's trust policy. Additionally, the administrator who passes the role to the service must have the iam:PassRole permission granted in their identity-based policy.
Step-by-Step Solution
Key Concept
Configuring trust policies and passing roles to AWS services