Examkin

Question

Difficulty: EasyIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps Administrator is configuring an AWS Lambda function to stop underutilized EC2 instances. The administrator has already created the required IAM execution role for Lambda with the correct permissions. However, when the administrator attempts to update the Lambda function configuration to use this execution role, the AWS Management Console displays an Access Denied error.

Which permission must be granted to the SysOps Administrator's IAM user policy to resolve this error?

  1. iam:PassRole on the Lambda execution role resourceAnswer
  2. B
    sts:AssumeRole on the Lambda execution role resource
  3. C
    sts:AssumeRole on the Lambda service principal
  4. D
    iam:GetRole on the Lambda execution role resource

Answer

iam:PassRole on the Lambda execution role resource
The correct answer is the option specifying 'iam:PassRole on the Lambda execution role resource'. When configuring an AWS service to assume an IAM role, the user performing the configuration action must have the iam:PassRole permission. This security control ensures that users cannot escalate their privileges by passing a highly privileged role to a service that they could then interact with or trigger.

Step-by-Step Solution

1
Identify the action causing the failure
The SysOps Administrator is attempting to associate (pass) an IAM role to an AWS service (AWS Lambda).
AWS services require permission to assume roles. To prevent users from passing roles with higher privileges than they themselves possess, AWS requires the configuring user to have the iam:PassRole permission.
2
Determine the required IAM permission for the configuring user
The configuring user's policy must include the iam:PassRole action with the Lambda execution role's ARN as the resource.
This grants the administrator the capability to delegate the role's permissions to the AWS Lambda service.

Key Concept

Delegating permissions to AWS services using the iam:PassRole policy permission
Estimated Time:1m 0s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic