Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an Amazon Kinesis Data Firehose delivery stream to stream application logs to an Amazon S3 bucket. The destination S3 bucket is encrypted using a customer managed AWS KMS key. The administrator creates a custom IAM role named FirehoseDeliveryRole to allow the delivery stream to access the S3 bucket and use the KMS key. Which of the following configurations are required to ensure the delivery stream is created successfully and can write encrypted logs? (Select TWO.)

  1. Configure the trust policy of FirehoseDeliveryRole to allow the firehose.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  2. Attach an IAM policy to the SysOps administrator's IAM identity that grants the iam:PassRole permission for the FirehoseDeliveryRole resource.Answer
  3. C
    Attach an IAM policy to the SysOps administrator's IAM identity that grants the sts:AssumeRole permission for the FirehoseDeliveryRole resource.
  4. D
    Attach an IAM policy to the SysOps administrator's IAM identity that grants kms:GenerateDataKey and kms:Decrypt permissions on the KMS key to authorize the encryption, without modifying the key policy.

Answer

To configure the delivery stream, the trust policy of FirehoseDeliveryRole must allow the firehose.amazonaws.com service principal to perform the sts:AssumeRole action, and the administrator's IAM identity must be granted the iam:PassRole permission for the FirehoseDeliveryRole resource.
To configure Kinesis Data Firehose to deliver encrypted data, the service must assume the role using sts:AssumeRole, which requires the firehose.amazonaws.com service principal to be trusted in the role's trust policy. Furthermore, the administrator needs the iam:PassRole permission to safely associate the role with the delivery stream.

Step-by-Step Solution

1
Determine how the Kinesis Data Firehose service assumes the role to interact with resources.
The service principal firehose.amazonaws.com must be explicitly allowed to perform sts:AssumeRole in the FirehoseDeliveryRole's trust policy.
Service trust policies are required to delegate permissions to AWS service principals.
2
Determine the permissions needed by the administrator to assign this role to the delivery stream.
The administrator's IAM policy must grant iam:PassRole on the FirehoseDeliveryRole resource.
iam:PassRole is required to ensure users do not elevate their privileges by assigning roles they are not authorized to delegate.
3
Verify KMS key authorization requirements.
The key policy of the customer managed KMS key must explicitly allow the FirehoseDeliveryRole to perform kms:GenerateDataKey and kms:Decrypt.
IAM policies on their own cannot authorize access to a customer managed KMS key unless the key policy explicitly allows delegation to IAM.

Key Concept

Configuring service roles, service trust relationships, iam:PassRole, and KMS key policies for AWS services.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic