Examkin

Question

Difficulty: MediumS3 Reliability and Replication

An administrator is establishing Same-Region Replication (SRR) for an Amazon S3 bucket within a single AWS account. Both the source and destination buckets have versioning active. The administrator has created a replication IAM role with a trust policy for `s3.amazonaws.com` and a permissions policy that allows `s3:ReplicateObject` on the destination. However, when the administrator executes `aws s3api put-bucket-replication` from their local machine, they receive an 'AccessDenied' error.

Which of the following is the most likely cause of this failure?

  1. A
    The replication IAM role trust policy must specify the administrator's IAM user in the Principal element and grant the `sts:AssumeRole` permission.
  2. The IAM user executing the CLI command does not have the `iam:PassRole` permission to pass the replication role to the Amazon S3 service.Answer
  3. C
    The destination bucket has versioning enabled, but S3 replication requires versioning to be enabled only on the source bucket and suspended on the destination bucket.
  4. D
    The KMS key policy for the destination bucket's encryption key does not permit the administrator's IAM user to access it, overriding the IAM policy.

Answer

The IAM user executing the CLI command does not have the `iam:PassRole` permission to pass the replication role to the Amazon S3 service.
The correct answer is correct because setting up S3 replication requires the user to pass an IAM service role to Amazon S3. AWS enforces security by requiring that the identity configuring replication must have the `iam:PassRole` permission for the specific IAM role. Without this permission, the AWS CLI command will return an Access Denied error.

Step-by-Step Solution

1
Determine the permissions required to associate an IAM role with an AWS service.
Associating an IAM service role with a resource like an S3 replication configuration requires the caller to have the `iam:PassRole` permission for that role.
This prevents unauthorized users from passing administrative or privileged roles to services.
2
Verify if the CLI command is failing due to role configuration or command authorization.
Since versioning is enabled and the role's trust policy is configured, the API execution itself is blocked, indicating a user authorization issue rather than a service validation issue.
An AccessDenied error on the API endpoint when setting configurations with a role parameter typically points to a missing `iam:PassRole` permission on the user.

Key Concept

IAM PassRole permission requirement for service role delegation
Estimated Time:1m 30s
Rate this question

Topics

S3 Reliability and Replication

More questions from this topic