Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an Amazon EC2 instance to execute a script that automatically retrieves configuration parameters from AWS Systems Manager Parameter Store. The administrator creates an IAM role named EC2ParameterStoreRole with the appropriate permissions and a trust policy that allows ec2.amazonaws.com to assume the role. A junior technician is assigned to launch the EC2 instance using the AWS CLI and associate the EC2ParameterStoreRole with the instance. The technician's IAM policy grants full access to EC2 (ec2:*). When attempting to run the CLI command to launch the instance with the specified role, the command fails with an UnauthorizedOperation error. Which action must the administrator add to the technician's IAM policy to resolve this error?

  1. A
    sts:AssumeRole for the ARN of the EC2ParameterStoreRole role
  2. B
    iam:GetRole for the ARN of the EC2ParameterStoreRole role
  3. iam:PassRole for the ARN of the EC2ParameterStoreRole roleAnswer
  4. D
    iam:AssociateInstanceProfile for the ARN of the EC2ParameterStoreRole role

Answer

iam:PassRole for the ARN of the EC2ParameterStoreRole role
To configure an AWS service (such as Amazon EC2) with an IAM role, the user performing the configuration must be authorized to pass that role to the service. The iam:PassRole permission grants this authorization. Since the technician has full EC2 permissions but lacks the ability to pass the specific IAM role, the launch operation fails with an UnauthorizedOperation error. Adding iam:PassRole for the EC2ParameterStoreRole role resolves the issue.

Step-by-Step Solution

1
Analyze the error message and current permissions.
The technician has full EC2 permissions (ec2:*) but receives an UnauthorizedOperation error when attempting to launch an EC2 instance with an associated IAM role.
This indicates that the restriction is on the IAM side rather than the EC2 side.
2
Identify the mechanism AWS uses to prevent unauthorized role delegation.
AWS requires users to have the iam:PassRole permission to pass an IAM role to an AWS service like Amazon EC2.
This prevents users from escalating their own privileges by passing roles with higher permissions than their own to services.
3
Select the correct permission required on the technician's IAM policy.
Adding iam:PassRole for the specific ARN of the EC2ParameterStoreRole role to the technician's policy allows them to successfully launch the instance with the role.
This completes the delegation chain safely and satisfies the authorization check.

Key Concept

Delegating IAM roles to AWS services requires the user to have iam:PassRole permissions on the target role.
Estimated Time:1m 30s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic