Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

A SysOps Administrator is configuring a VPC Flow Log to deliver traffic logs to an Amazon CloudWatch Logs log group. The administrator has created the log group and an IAM role with a trust policy that allows the VPC Flow Logs service principal to assume the role. The IAM role has a permissions policy that allows it to create log streams and put log events. However, when the administrator attempts to create the VPC Flow Log using the AWS CLI, the command fails with an Access Denied error.

Which of the following is the most likely cause of this issue?

  1. The IAM policy attached to the SysOps Administrator's user account lacks the iam:PassRole permission for the VPC Flow Logs service role.Answer
  2. B
    The CloudWatch Logs log group has an indefinite retention period (Never Expire), which prevents the VPC Flow Logs service from establishing the log delivery stream.
  3. C
    The IAM role's trust policy is missing the sts:AssumeRole action for the SysOps Administrator's user ARN.
  4. D
    The KMS key policy attached to the CloudWatch Logs log group does not permit the SysOps Administrator's IAM user to encrypt log streams.

Answer

The IAM policy attached to the SysOps Administrator's user account lacks the iam:PassRole permission for the VPC Flow Logs service role.
To create a VPC Flow Log that publishes to CloudWatch Logs, you must pass the IAM role that has permissions to write to CloudWatch Logs. AWS requires the user creating the flow log to have the iam:PassRole permission on that role to prevent unauthorized escalation of privileges.

Step-by-Step Solution

1
Identify the AWS service interaction requirements for VPC Flow Logs.
VPC Flow Logs requires an IAM role to publish to CloudWatch Logs on behalf of the user.
This is a cross-service configuration where AWS VPC delegates writing logs to CloudWatch Logs using a service role.
2
Analyze the permission required by the administrator's user identity to associate the role.
The administrator must have the iam:PassRole permission to pass the role to the VPC Flow Logs service.
Without iam:PassRole, the IAM user cannot associate a service role with an AWS resource, resulting in an Access Denied error during creation.

Key Concept

VPC Flow Logs IAM Delegation and PassRole Permissions
Estimated Time:1m 30s
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic