Examkin

Question

Difficulty: HardS3 Reliability and Replication

A SysOps Administrator is configuring Amazon S3 Cross-Region Replication (CRR) between a source bucket and a destination bucket using the AWS CLI. The administrator has already created an IAM role (`arn:aws:iam::123456789012:role/S3ReplicationRole`) with a trust policy allowing `s3.amazonaws.com` to assume it, and a permissions policy allowing replication actions. Both buckets have versioning enabled.

However, when the administrator runs the `aws s3api put-bucket-replication` command to apply the configuration, the command fails with the following error:

`An error occurred (AccessDenied) when calling the PutBucketReplication operation: Access Denied`

An inspection of the administrator's IAM policy shows full permissions to S3 (`s3:*`). Which of the following is the root cause of this error?

  1. A
    Versioning has not been enabled on the destination S3 bucket, causing S3 to deny the replication configuration request.
  2. B
    The trust policy of the S3 replication IAM role does not list the administrator's IAM user as a trusted principal.
  3. C
    The administrator's IAM policy lacks the `sts:AssumeRole` permission for the S3 replication role.
  4. The administrator's IAM policy does not grant the `iam:PassRole` permission for the S3 replication role.Answer

Answer

The administrator's IAM policy does not grant the `iam:PassRole` permission for the S3 replication role.
To configure S3 replication, the administrator must pass the replication IAM role to the S3 service. This requires the `iam:PassRole` permission in the administrator's IAM policy. Without this permission, S3 cannot verify that the administrator is authorized to delegate these permissions, resulting in an `AccessDenied` error during the configuration attempt.

Step-by-Step Solution

1
Analyze the error message and current configurations.
The API call fails with AccessDenied on the PutBucketReplication operation, despite the administrator having s3:* permissions.
This indicates that the operation requires permissions outside of the S3 service actions.
2
Identify the IAM permissions required to pass a service role to S3.
When configuring a service like S3 replication that assumes a role, the IAM principal setting up the replication must be allowed to pass that role to the service principal.
The iam:PassRole action is used to authorize a user to pass an IAM role to an AWS service.
3
Verify if the administrator has the iam:PassRole permission.
The administrator has s3:* permissions but does not have the iam:PassRole permission in their IAM policy.
S3 denies the request because the administrator is attempting to associate a role they do not have permission to pass.

Key Concept

IAM PassRole permission requirement for service role delegation
Rate this question

Topics

S3 Reliability and Replication

More questions from this topic