Examkin

Question

Difficulty: HardAWS Elastic Disaster Recovery

A SysOps Administrator is managing cross-Region disaster recovery using AWS Elastic Disaster Recovery (AWS DRS) to protect a critical business application. The application's EC2 instances in us-east-1 are replicated to a staging area in us-west-2. The instances are configured with an IAM instance profile associated with a role named ApplicationStorageAccessRole that permits access to Amazon S3. During a disaster recovery drill in us-west-2, the administrator attempts to launch recovery instances, but the launch fails. The EC2 launch history shows an authorization error indicating that the administrator is not authorized to perform the action on the resource. Which action must the administrator take to successfully launch the recovery instances during the drill?

  1. A
    Update the trust policy of ApplicationStorageAccessRole to allow the AWS Elastic Disaster Recovery service (drs.amazonaws.com) to assume the role.
  2. Add the iam:PassRole permission for the ApplicationStorageAccessRole to the IAM identity of the administrator initiating the drill.Answer
  3. C
    Configure an Amazon Route 53 active-active failover routing policy to automatically route application traffic to the staging subnet in us-west-2 during the drill.
  4. D
    Modify the administrator's IAM policy to grant kms:Decrypt permissions on the AWS DRS replication key, ignoring the key policy restrictions in the destination Region.

Answer

Add the iam:PassRole permission for the ApplicationStorageAccessRole to the IAM identity of the administrator initiating the drill.
To launch recovery instances with an IAM instance profile, the IAM identity initiating the drill or failover (the SysOps Administrator) must have the iam:PassRole permission for the IAM role associated with the instance profile. This allows the administrator to pass the role to the EC2 service when the instances are created in the target Region.

Step-by-Step Solution

1
Identify the IAM role specified in the EC2 Launch Template of the source instances, which is ApplicationStorageAccessRole.
Confirming the target role that must be associated with the recovery instances.
AWS Elastic Disaster Recovery uses EC2 Launch Templates to launch target recovery instances with their original configurations, including IAM roles.
2
Evaluate the IAM permissions of the administrator initiating the disaster recovery drill.
Recognize that the administrator lacks the iam:PassRole permission for the ApplicationStorageAccessRole.
To prevent privilege escalation, AWS requires users who launch EC2 instances with an IAM role to possess the iam:PassRole permission for that specific role.
3
Add an IAM policy granting the iam:PassRole permission for the ApplicationStorageAccessRole to the administrator's IAM user or role.
The administrator is now authorized to initiate the drill launch with the instance profile.
This permission allows the administrator to pass the role to the EC2 service, enabling the launch of the recovery instances with the required role.

Key Concept

AWS Elastic Disaster Recovery (AWS DRS) utilizes EC2 Launch Templates to deploy target recovery instances. When these instances require an IAM role via an instance profile, the user initiating the recovery or drill must have the iam:PassRole permission for that role to successfully complete the launch.
Rate this question

Topics

AWS Elastic Disaster Recovery

More questions from this topic