Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A company's SysOps team is setting up AWS Backup to centralize backup management. A SysOps administrator is configuring a backup plan that must use a custom IAM service role to back up Amazon RDS instances. The administrator needs to grant the AWS Backup service the permissions to assume this role, and also ensure that the administrator has the permissions required to assign this role to the backup plan. Which two configuration steps must be performed to meet these requirements?

  1. Configure the trust policy of the IAM role to allow the backup.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  2. Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the IAM role's Amazon Resource Name (ARN).Answer
  3. C
    Attach an IAM policy to the administrator's IAM identity that grants the sts:AssumeRole permission for the IAM role's Amazon Resource Name (ARN).
  4. D
    Configure the trust policy of the IAM role to allow the administrator's IAM identity to perform the iam:PassRole action.

Answer

To establish this access, the trust policy of the IAM role must allow the AWS Backup service principal to perform the sts:AssumeRole action, and the administrator's identity must be granted the iam:PassRole permission for the role's ARN.
To delegate permissions to an AWS service, two parts are required: the service itself must be trusted to assume the role, and the user setting up the configuration must have permission to pass the role to the service. The service trust is established via the trust policy using the sts:AssumeRole action, and user permission to delegate the role is granted via the identity-based policy using the iam:PassRole permission.

Step-by-Step Solution

1
Configure the trust relationship on the target IAM service role.
The AWS Backup service principal (backup.amazonaws.com) is permitted to assume the role to execute the backup plan.
AWS services require a trust policy to assume roles within an account.
2
Configure the administrator's IAM permissions.
The administrator's IAM user or group policy contains a statement granting iam:PassRole for the backup role's ARN.
When an administrator assigns a role to a service, AWS checks if they have permission to pass that specific role.

Key Concept

Delegating permissions to AWS services using service trust policies and iam:PassRole.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic