Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an AWS Systems Manager (SSM) Automation runbook in Account A (111122223333111122223333) to automate security analysis. The runbook runs under the execution context of a service role named SSMAutomationServiceRole. The runbook is designed to launch a temporary Amazon EC2 instance that will perform the analysis. The EC2 instance must be launched with an instance profile associated with an IAM role named DiskAnalyzerInstanceRole.

Which of the following configuration steps must the administrator perform to ensure that the runbook can successfully launch the EC2 instance with the required role? (Select TWO.)

  1. Configure the trust policy of DiskAnalyzerInstanceRole to allow the ec2.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  2. Attach an IAM policy to SSMAutomationServiceRole that allows the iam:PassRole action on the ARN of DiskAnalyzerInstanceRole.Answer
  3. C
    Configure the trust policy of DiskAnalyzerInstanceRole to allow the ssm.amazonaws.com service principal to perform the sts:AssumeRole action.
  4. D
    Attach an IAM policy to SSMAutomationServiceRole that allows the sts:AssumeRole action on the ARN of DiskAnalyzerInstanceRole.

Answer

Configure the trust policy of DiskAnalyzerInstanceRole to allow the ec2.amazonaws.com service principal to perform the sts:AssumeRole action, and attach an IAM policy to SSMAutomationServiceRole that allows the iam:PassRole action on the ARN of DiskAnalyzerInstanceRole.
The configuration requires two distinct elements: First, the Systems Manager service role (SSMAutomationServiceRole) must have permission to pass the instance role to the EC2 service using the iam:PassRole permission. Second, the trust policy of the instance role (DiskAnalyzerInstanceRole) must trust the EC2 service principal (ec2.amazonaws.com) to perform sts:AssumeRole, which allows the instance to assume the role upon launch.

Step-by-Step Solution

1
Determine which service principal is assuming the instance role.
The EC2 service (ec2.amazonaws.com) is the service principal that assumes the DiskAnalyzerInstanceRole to retrieve temporary credentials for the instance.
This establishes the trust relationship required for the EC2 instance to execute actions with the permissions of the role.
2
Configure the trust relationship policy on the instance role.
The trust policy of DiskAnalyzerInstanceRole is updated to allow the ec2.amazonaws.com service principal to assume the role.
This satisfies the AWS requirement that any principal assuming a role must be trusted in that role's trust policy.
3
Determine the permission required by the execution role to associate the instance role with the EC2 instance.
The SSMAutomationServiceRole requires the iam:PassRole permission on the DiskAnalyzerInstanceRole resource.
AWS prevents unauthorized role association by requiring the service/identity launching the resource to have explicit permission to pass that specific IAM role.

Key Concept

IAM PassRole vs AssumeRole and Service Trust Relationships
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic