Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring a Python script to automate the remediation of non-compliant Amazon EC2 instances. The script associates an IAM instance profile containing the IAM role `AppLoggingRole` with EC2 instances that currently lack one.

The administrator's IAM user has the following IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:AssociateIamInstanceProfile",
"ec2:ReplaceIamInstanceProfileAssociation"
],
"Resource": "*"
}
]
}

When running the script, the `ec2:AssociateIamInstanceProfile` API call fails with an `AccessDenied` error.

Which of the following is the root cause of this error?

  1. The administrator's IAM user lacks the iam:PassRole permission to pass the AppLoggingRole role to the Amazon EC2 service.Answer
  2. B
    The trust policy of the AppLoggingRole role does not allow the administrator's IAM user to perform the sts:AssumeRole action.
  3. C
    The Amazon EC2 service principal (ec2.amazonaws.com) is not listed in the trust relationship of the AppLoggingRole role.
  4. D
    The administrator's IAM policy must include the sts:AssumeRole permission for the AppLoggingRole role instead of EC2 actions.

Answer

The administrator's IAM user lacks the iam:PassRole permission to pass the AppLoggingRole role to the Amazon EC2 service.
To associate an IAM instance profile with an EC2 instance, the SysOps administrator's IAM user must have the iam:PassRole permission. This permission allows the user to pass the specified role to the Amazon EC2 service. Without it, the ec2:AssociateIamInstanceProfile API call returns an AccessDenied error.

Step-by-Step Solution

1
Analyze the IAM policy attached to the SysOps administrator's IAM user.
The policy permits EC2 operations (DescribeInstances, AssociateIamInstanceProfile, ReplaceIamInstanceProfileAssociation) but does not permit any IAM operations.
Determining user permissions is the first step in diagnosing Access Denied errors.
2
Identify the AWS mechanism used when associating an IAM role with an AWS service.
AWS requires the calling identity to have the iam:PassRole permission to verify that the user is authorized to delegate the role's permissions to the service.
This prevents unauthorized users from elevating their privileges by assigning powerful roles to services they can control.
3
Differentiate between the root cause of the API failure and post-assignment issues.
The failure occurs at the ec2:AssociateIamInstanceProfile API level, which is governed by user permissions (including iam:PassRole), rather than the role's trust policy (which controls the EC2 service's ability to assume the role later).
This clarifies why missing trust relationships or lack of sts:AssumeRole do not cause the association API itself to fail.

Key Concept

IAM PassRole Permission for Service Delegation
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic