Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring a third-party monitoring application running on Amazon EC2 instances in a Shared Services account (333333333333333333333333). The application needs to analyze logs stored in an Amazon S3 bucket within a Production account (444444444444444444444444). The S3 bucket is encrypted with an AWS KMS Customer Managed Key (CMK) in the Production account. The application runs under an IAM instance profile associated with a role named `EC2MonitorRole` in the Shared Services account, and it must assume an IAM role named `CrossAccountReaderRole` in the Production account to read the S3 objects. Which of the following configuration steps are required to establish this cross-account access? (Select TWO.)

  1. Modify the trust policy of the `CrossAccountReaderRole` in the Production account (444444444444444444444444) to allow the `sts:AssumeRole` action for the `arn:aws:iam::333333333333:role/EC2MonitorRole` principal.Answer
  2. Attach a permissions policy to the `EC2MonitorRole` in the Shared Services account (333333333333333333333333) that allows the `sts:AssumeRole` action on `arn:aws:iam::444444444444:role/CrossAccountReaderRole`.Answer
  3. C
    Attach an IAM policy to the `EC2MonitorRole` in the Shared Services account (333333333333333333333333) that grants the `iam:PassRole` permission for the `arn:aws:iam::444444444444:role/CrossAccountReaderRole` resource.
  4. D
    Attach an IAM permissions policy directly to the `EC2MonitorRole` in the Shared Services account (333333333333333333333333) allowing the `kms:Decrypt` action on the KMS CMK in the Production account (444444444444444444444444), without modifying the KMS key policy.

Answer

Modify the trust policy of the target role in the Production account to trust the source role, and attach an IAM policy to the source role allowing it to assume the target role.
Establishing cross-account access requires configuring permissions on both sides of the trust boundary. First, the source role must have permissions to initiate the assume-role request. Second, the target role's trust policy must list the source role as a trusted principal to allow the request.

Step-by-Step Solution

1
Determine the delegation mechanism for cross-account access.
The EC2 instance profile's role (EC2MonitorRole) in the Shared Services account must call AWS STS to assume the target role (CrossAccountReaderRole) in the Production account.
This establishes a security boundary where temporary credentials are used to access the destination account's resources.
2
Configure the trust relationship on the target role.
The target role (CrossAccountReaderRole) trusts the source role (EC2MonitorRole) as a principal for the sts:AssumeRole action.
The target account must explicitly authorize which external entities are allowed to assume its roles.
3
Configure permissions on the source role.
The source role (EC2MonitorRole) is granted permission to perform sts:AssumeRole on the target role's ARN.
The source account's IAM policies must allow the identity to make the outbound sts:AssumeRole API call.

Key Concept

Cross-account trust delegation using IAM roles and AWS STS.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic