Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator has the following IAM policy attached to their IAM user:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EC2LaunchPermissions",
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:AssociateIamInstanceProfile"
],
"Resource": "*"
}
]
}

The administrator attempts to launch an Amazon EC2 instance and associate it with an existing IAM role named `WebServerRole` by running the following AWS CLI command:

`aws ec2 run-instances --image-id ami-0c55b159cbfafe1f0 --instance-type t3.micro --iam-instance-profile Name=WebServerProfile`

The command fails with the following error message:
`An error occurred (UnauthorizedOperation) when calling the RunInstances operation: User: arn:aws:iam::123456789012:user/AdminUser is not authorized to perform: iam:PassRole on resource: arn:aws:iam::123456789012:role/WebServerRole`

What modification should the administrator make to their user's IAM policy to successfully run the command?

  1. Add a statement to the user's IAM policy that allows the iam:PassRole action with the resource set to the ARN of the WebServerRole.Answer
  2. B
    Add a statement to the user's IAM policy that allows the sts:AssumeRole action with the resource set to the ARN of the WebServerRole.
  3. C
    Add a statement to the user's IAM policy that allows the iam:PassRole action with the resource set to the ARN of the WebServerProfile instance profile.
  4. D
    Modify the trust relationship policy of the WebServerRole to allow the administrator's user to perform the sts:AssumeRole action.

Answer

Add a statement to the user's IAM policy that allows the iam:PassRole action with the resource set to the ARN of the WebServerRole.
To launch an EC2 instance with an IAM role, the administrator must have permission to associate that role with the instance. This is governed by the iam:PassRole permission. Adding a statement to the user's policy allowing the iam:PassRole action on the WebServerRole ARN grants this permission.

Step-by-Step Solution

1
Identify the missing permission from the CLI error message.
The error message explicitly states that the user is not authorized to perform the iam:PassRole action on the WebServerRole resource.
Before an AWS service like EC2 can assume an IAM role, the user setting up the resource must possess permission to pass that role to the service.
2
Add the required permission to the administrator's IAM policy.
The iam:PassRole action is added, targeting the specific ARN of the WebServerRole.
This grants the administrator the client-side privilege to delegate the WebServerRole to the EC2 instance.

Key Concept

Delegating permissions to AWS services using the iam:PassRole action
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic