Examkin

Question

Difficulty: Very hardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an AWS Systems Manager (SSM) Automation workflow in a multi-account organization. The administrator initiates execution from Account A (Operations, 111111111111) to remediate non-compliant EC2 instances in Account B (Production, 222222222222).

The workflow uses a custom automation execution role in Account B called SSMExecutionRole to perform remediation actions, which include attaching an IAM role named RemediationEC2Role to the target EC2 instances.

The administrator has configured the following:
1. The IAM role CentralOpsRole in Account A has permissions to assume SSMExecutionRole in Account B.
2. The trust policy of SSMExecutionRole in Account B allows CentralOpsRole to assume it.
3. The trust policy of RemediationEC2Role in Account B allows ec2.amazonaws.com to assume it.

The administrator initiates the automation execution from Account A using the assumed credentials of SSMExecutionRole. The execution fails at the step that associates RemediationEC2Role with the target EC2 instances with an AccessDenied error stating that the caller is not authorized to perform iam:PassRole.

Which configuration change is required to resolve this error using the principle of least privilege?

  1. Attach an IAM policy to the SSMExecutionRole in Account B that grants the iam:PassRole permission for the RemediationEC2Role ARN, specifying ec2.amazonaws.com in the iam:PassedToService condition key.Answer
  2. B
    Attach an IAM policy to the CentralOpsRole in Account A that grants the iam:PassRole permission for the SSMExecutionRole ARN, allowing it to be passed to ssm.amazonaws.com.
  3. C
    Modify the trust policy of the RemediationEC2Role in Account B to allow the sts:AssumeRole action for the CentralOpsRole ARN from Account A.
  4. D
    Attach an IAM policy to the CentralOpsRole in Account A that grants the sts:AssumeRole permission for the RemediationEC2Role ARN in Account B.

Answer

Attach an IAM policy to the SSMExecutionRole in Account B that grants the iam:PassRole permission for the RemediationEC2Role ARN, specifying ec2.amazonaws.com in the iam:PassedToService condition key.
The correct answer is correct because the SSMExecutionRole in Account B is the active session executing the command that associates RemediationEC2Role with the target EC2 instances. To attach an IAM role to an EC2 instance, the caller must have the iam:PassRole permission for that role. Restricting the permission with the iam:PassedToService condition key to ec2.amazonaws.com aligns with the principle of least privilege.

Step-by-Step Solution

1
Identify the identity performing the failing action.
The SSMExecutionRole in Account B is the active caller performing the remediation step that associates the role with the EC2 instance.
Permissions are evaluated for the credentials currently executing the action, which are those of the assumed role session in Account B.
2
Identify the required IAM action for associating a role with an EC2 instance.
The iam:PassRole action is required to delegate permissions to an AWS service like Amazon EC2.
When attaching a role to an EC2 instance, the service must be allowed to assume that role on behalf of the user, which requires passing the role.
3
Formulate the least privilege policy.
Create a policy granting iam:PassRole for the specific role ARN and use the iam:PassedToService condition key to restrict the destination service.
Using the iam:PassedToService condition prevents the role from being passed to unauthorized services.

Key Concept

Understanding iam:PassRole vs sts:AssumeRole in cross-account service delegation
Estimated Time:3m 0s
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic