Examkin

Question

Difficulty: Very hardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring a multi-account execution workflow using AWS Systems Manager (SSM) Automation in Account A (111111111111111111111111). The SSM Automation execution must perform two primary functions: launch a temporary Amazon EC2 instance in Account A and attach a pre-existing IAM role named `EC2DataProcessorRole` to it, and assume a cross-account IAM role named `S3ReaderRole` in Account B (222222222222222222222222) to read data files from an Amazon S3 bucket. The SSM Automation workflow runs under a service role named `SSMExecutionRole` in Account A. Which of the following configuration steps are required to achieve this setup? (Select TWO.)

  1. In Account A, attach a policy to SSMExecutionRole allowing the iam:PassRole action on the resource arn:aws:iam::111111111111:role/EC2DataProcessorRole, and the sts:AssumeRole action on the resource arn:aws:iam::222222222222:role/S3ReaderRole.Answer
  2. In Account B, configure the trust policy of S3ReaderRole to allow the principal arn:aws:iam::111111111111:role/SSMExecutionRole to perform the sts:AssumeRole action.Answer
  3. C
    In Account B, configure the trust policy of S3ReaderRole to allow the service principal ssm.amazonaws.com to perform the sts:AssumeRole action.
  4. D
    In Account A, attach a policy to SSMExecutionRole allowing the sts:AssumeRole action on the resource arn:aws:iam::111111111111:role/EC2DataProcessorRole, and the iam:PassRole action on the resource arn:aws:iam::222222222222:role/S3ReaderRole.
  5. E
    In Account A, apply a Service Control Policy (SCP) to explicitly allow the iam:PassRole action to the principal ssm.amazonaws.com across all resources.

Answer

In Account A, attach a policy to SSMExecutionRole allowing iam:PassRole on the EC2DataProcessorRole and sts:AssumeRole on the S3ReaderRole in Account B; and in Account B, configure the trust policy of S3ReaderRole to allow SSMExecutionRole to perform sts:AssumeRole.
The correct options state that the execution role in Account A requires iam:PassRole to assign the EC2 role, and sts:AssumeRole to assume the cross-account role. Concurrently, the trust policy of the cross-account role in Account B must trust the execution role from Account A to authorize the assume role operation.

Step-by-Step Solution

1
Configure role-passing permissions in Account A.
The SSMExecutionRole is granted the iam:PassRole permission on the target EC2DataProcessorRole.
When Systems Manager launches an EC2 instance and associates an IAM role, the systems manager execution role must have permission to pass that IAM role to the Amazon EC2 service.
2
Configure cross-account delegation permission in Account A.
The SSMExecutionRole is granted the sts:AssumeRole permission on the S3ReaderRole in Account B.
To assume a target role in another AWS account, the initiating IAM role must be granted permissions to request the STS security tokens.
3
Establish trust relationship in Account B.
The S3ReaderRole trust policy is configured to specify the SSMExecutionRole ARN as a trusted principal.
An IAM role cannot be assumed by an identity in another account unless its trust policy explicitly trusts that identity.

Key Concept

IAM PassRole vs AssumeRole in Multi-Account Service Delegations
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic