Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is setting up an Amazon Data Firehose delivery stream to send application logs to an Amazon S3 bucket. The administrator creates an IAM role named FirehoseDeliveryRole to grant Firehose write access to the S3 bucket. However, when attempting to create the delivery stream using the AWS CLI, the administrator receives an Access Denied error.

Which of the following actions are required to resolve this issue and successfully create the delivery stream? (Select TWO.)

  1. Add a policy to the administrator's IAM user that allows the iam:PassRole action on the FirehoseDeliveryRole resource.Answer
  2. Modify the trust policy of FirehoseDeliveryRole to allow the service principal firehose.amazonaws.com to perform the sts:AssumeRole action.Answer
  3. C
    Add a policy to the administrator's IAM user that allows the sts:AssumeRole action on the FirehoseDeliveryRole resource.
  4. D
    Add a policy to the administrator's IAM user that allows the iam:PassRole action on the S3 bucket resource.
  5. E
    Modify the trust policy of FirehoseDeliveryRole to allow the administrator's IAM user to perform the sts:AssumeRole action.

Answer

The correct options are: adding a policy to the administrator's IAM user that allows the iam:PassRole action on the FirehoseDeliveryRole resource, and modifying the trust policy of FirehoseDeliveryRole to allow the service principal firehose.amazonaws.com to perform the sts:AssumeRole action.
The correct configuration requires two parts. First, the administrator must have permission to associate the IAM role with the AWS service. This is controlled by granting the administrator's IAM user the iam:PassRole permission on the specific IAM role (FirehoseDeliveryRole). Second, the IAM role itself must trust the service that is going to assume it. This is done by modifying the trust policy of the role to allow the service principal firehose.amazonaws.com to perform the sts:AssumeRole action. Together, these two steps allow the administrator to pass the role and the Firehose service to assume it.

Step-by-Step Solution

1
Analyze the roles and permissions required when an administrator delegates an IAM role to an AWS service.
Identify that the administrator needs iam:PassRole to pass the execution role to the service, and the service needs a trust policy on the role to perform sts:AssumeRole.
This establishes the dual permissions model required for service role delegation in AWS.
2
Evaluate the administrator's user policy permissions.
Confirm that the user needs the iam:PassRole permission targeting the FirehoseDeliveryRole ARN.
Without this, AWS prevents the user from passing the role to the Amazon Data Firehose service.
3
Evaluate the FirehoseDeliveryRole trust policy.
Ensure that the trust policy allows firehose.amazonaws.com to assume the role.
Without a valid trust relationship, the service cannot assume the role to write logs to S3, even if the user has pass role permissions.

Key Concept

Delegating permissions to AWS services requires the user to have iam:PassRole permissions on the role, and the role's trust policy must allow the service principal to perform sts:AssumeRole.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic