Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an automated task using Amazon EventBridge Scheduler to run an AWS Systems Manager (SSM) Automation runbook (`AWS-StopEC2Instance`) on a weekly schedule. The SSM Automation runbook must execute using a service role named `SSMRemediationRole`. The EventBridge Scheduler schedule will run under a service role named `EventBridgeSchedulerExecutionRole`. When the administrator attempts to create the schedule using the AWS CLI, the command fails with an `AccessDeniedException` error. Which of the following actions must the administrator take to resolve this issue and successfully run the scheduled automation? (Select TWO.)

  1. Attach an IAM policy to the administrator's IAM identity that allows the `iam:PassRole` action on the `EventBridgeSchedulerExecutionRole` resource.Answer
  2. Attach an IAM policy to the `EventBridgeSchedulerExecutionRole` that allows the `iam:PassRole` action on the `SSMRemediationRole` resource.Answer
  3. C
    Attach an IAM policy to the administrator's IAM identity that allows the `sts:AssumeRole` action on the `EventBridgeSchedulerExecutionRole` resource.
  4. D
    Modify the trust policy of the `SSMRemediationRole` to allow the `scheduler.amazonaws.com` service principal to assume the role.
  5. E
    Attach an IAM policy to the `EventBridgeSchedulerExecutionRole` that allows the `sts:AssumeRole` action on the `SSMRemediationRole` resource.

Answer

Attach an IAM policy to the administrator's IAM identity that allows the `iam:PassRole` action on the `EventBridgeSchedulerExecutionRole` resource, and attach an IAM policy to the `EventBridgeSchedulerExecutionRole` that allows the `iam:PassRole` action on the `SSMRemediationRole` resource.
To resolve the access denied issue, two distinct `iam:PassRole` permissions are required. First, the administrator's IAM identity must be allowed to pass the scheduler execution role (`EventBridgeSchedulerExecutionRole`) to the EventBridge Scheduler service when creating the schedule. Second, because the scheduler must start the SSM Automation runbook using the remediation role (`SSMRemediationRole`), the scheduler's execution role itself must be allowed to pass the remediation role to the Systems Manager service.

Step-by-Step Solution

1
Identify the permission required for the administrator to associate the execution role with the EventBridge Scheduler schedule.
The administrator's IAM identity requires `iam:PassRole` on the `EventBridgeSchedulerExecutionRole` to delegate permissions to the Scheduler service.
When configuring AWS services to act on behalf of a user, the user must have permission to pass the role to the service.
2
Identify the permission required for the EventBridge Scheduler to trigger SSM Automation and pass the target execution role.
The EventBridge Scheduler execution role requires `iam:PassRole` on the `SSMRemediationRole` resource.
Because the Scheduler service is starting an SSM Automation execution that requires its own service role, the Scheduler's role must have permission to pass that target role to the Systems Manager service.
3
Differentiate between `iam:PassRole` and `sts:AssumeRole` permissions.
`iam:PassRole` is an IAM permission checked when passing a role to a service, whereas `sts:AssumeRole` is an STS API call used by the service principal or entity to assume the role.
Understanding this distinction eliminates distractors that incorrectly suggest the administrator or the Scheduler role needs `sts:AssumeRole` permissions.

Key Concept

Configuring IAM PassRole and service delegation for multi-layered service invocations.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic