Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an administration workflow where an automation tool running on an Amazon EC2 instance in Account A needs to launch new EC2 instances in the same account and attach a pre-configured IAM role named "WebServerRole" to them. The EC2 instance hosting the automation tool currently has permissions to perform the ec2:RunInstances action. However, when the automation tool attempts to launch a new instance with the "WebServerRole" attached, it receives an authorization error. Which of the following actions should the SysOps administrator take to resolve this issue? (Select TWO.)

  1. Attach an IAM policy to the automation tool's IAM role that grants the iam:PassRole permission for the WebServerRole resource.Answer
  2. Configure the trust policy of the WebServerRole to allow the ec2.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  3. C
    Attach an IAM policy to the automation tool's IAM role that grants the sts:AssumeRole permission for the WebServerRole resource.
  4. D
    Configure the trust policy of the WebServerRole to allow the IAM role of the automation tool to perform the iam:PassRole action.
  5. E
    Modify the trust policy of the automation tool's IAM role to allow the ec2.amazonaws.com service principal to perform the iam:PassRole action.

Answer

To resolve the issue, the administrator must grant the automation tool's IAM role permission to perform the iam:PassRole action on the WebServerRole, and configure the WebServerRole's trust policy to allow the ec2.amazonaws.com service principal to perform the sts:AssumeRole action.
To successfully launch an EC2 instance with an IAM role attached, the caller must have the permission to pass the role to the service, and the service must have the trust relationship to assume the role. The correct actions are granting the caller's IAM role permission to perform the iam:PassRole action on the target role, and configuring the target role's trust policy to allow the ec2.amazonaws.com service principal to assume it.

Step-by-Step Solution

1
Determine the role-passing requirements for the launching entity.
The automation tool's IAM role must be granted the iam:PassRole permission targeting the WebServerRole ARN.
AWS requires that any identity associating an IAM role with an AWS service must have explicit permission to pass that role to prevent unauthorized privilege escalation.
2
Determine the trust relationship requirements for the target role.
The WebServerRole's trust policy must allow the ec2.amazonaws.com service principal to perform sts:AssumeRole.
When the instance launches, the Amazon EC2 service must be allowed to assume the associated role to fetch temporary credentials.

Key Concept

Successful service role delegation requires that the calling identity has iam:PassRole permissions on the target role, and the target role's trust policy allows the service principal to perform sts:AssumeRole.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic