Examkin

Question

Difficulty: Very hardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator with the IAM user name `ManagerUser` in Account A (111122223333111122223333) needs to launch an Amazon EC2 instance that runs automated deployment scripts. The scripts will create IAM roles and attach permissions policies. The instance must run with an IAM instance profile associated with the IAM role named `DeploymentWorkerRole`.

An organization-level Service Control Policy (SCP) is attached to the Organizational Unit (OU) containing Account A:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "RestrictRoleCreation",
"Effect": "Deny",
"Action": [
"iam:CreateRole",
"iam:AttachRolePolicy"
],
"Resource": "*",
"Condition": {
"ArnNotEquals": {
"aws:PrincipalARN": "arn:aws:iam::111122223333:role/DeploymentWorkerRole"
}
}
}
]
}

`ManagerUser` has an IAM policy attached that grants full access to EC2 and Auto Scaling (`ec2:*` and `autoscaling:*`). When `ManagerUser` attempts to launch the EC2 instance using the AWS CLI and specifies the `DeploymentWorkerRole` instance profile, the operation fails with an `UnauthorizedOperation` error.

Which configuration change is required to resolve this issue and successfully launch the EC2 instance?

  1. A
    The trust policy of the DeploymentWorkerRole must be updated to allow the ManagerUser principal to perform the sts:AssumeRole action.
  2. B
    The KMS key policy of the default key used for EBS encryption must be updated to allow the ManagerUser to perform the kms:Decrypt and kms:GenerateDataKey actions.
  3. The administrator's IAM policy must be updated to grant the iam:PassRole permission for the DeploymentWorkerRole resource.Answer
  4. D
    The route table for the subnet must be updated to associate a gateway endpoint for S3 and EC2, resolving the connectivity failure.

Answer

The administrator's IAM policy must be updated to grant the iam:PassRole permission for the DeploymentWorkerRole resource.
To successfully launch an Amazon EC2 instance with an IAM instance profile, the IAM identity making the request must have the `iam:PassRole` permission for the associated role resource. This permission allows the user to pass the role to the Amazon EC2 service, which then assumes the role on the instance's behalf. Since `ManagerUser` only had `ec2:*` and `autoscaling:*` permissions, the lack of `iam:PassRole` caused the `RunInstances` API call to fail with an `UnauthorizedOperation` error.

Step-by-Step Solution

1
Analyze the error message and context.
The CLI operation fails with `UnauthorizedOperation` (Access Denied) during the instance launch phase before the instance starts running.
This indicates that the caller, `ManagerUser`, lacks the necessary permissions to execute the API call under the specified parameters (which includes attaching an IAM instance profile).
2
Evaluate the Service Control Policy (SCP) restriction.
The SCP denies `iam:CreateRole` and `iam:AttachRolePolicy` to any principal other than `DeploymentWorkerRole`.
The SCP does not block `ec2:RunInstances` or `iam:PassRole`, meaning the block is not coming from the organization level during the launch process.
3
Determine the role delegation requirements for Amazon EC2.
To associate a role with an EC2 instance, the user launching the instance must be allowed to pass the role to the Amazon EC2 service.
This authorization is governed by the `iam:PassRole` action on the target role resource within the user's IAM permissions policy.

Key Concept

IAM PassRole vs AssumeRole in service authorization
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic