Examkin

Question

Difficulty: Very hardS3 Reliability and Replication

A SysOps Administrator is setting up Same-Region Replication (SRR) between two Amazon S3 buckets within the same AWS account using the AWS CLI. The administrator has successfully enabled bucket versioning on both the source and destination S3 buckets. Additionally, they created an IAM service role named S3ReplicationServiceRole with a trust policy allowing the s3.amazonaws.com service principal to assume the role. The role's permissions policy grants all necessary S3 permissions to access the source bucket and write replicas to the destination bucket.

When the administrator attempts to apply the replication configuration using the command:

aws s3api put-bucket-replication --bucket source-bucket --replication-configuration file://replication.json

the command fails with an AccessDenied error. The administrator is currently logged in with an IAM user account that has the AWS managed AmazonS3FullAccess policy attached, but no other IAM permissions. Which modification is required to resolve this error and successfully apply the replication configuration?

  1. A
    Suspend versioning on the destination bucket to prevent potential replication loops.
  2. Add the iam:PassRole permission for the S3ReplicationServiceRole to the administrator's IAM user policy.Answer
  3. C
    Update the trust policy of S3ReplicationServiceRole to allow the administrator's IAM user to perform the sts:AssumeRole action.
  4. D
    Modify the destination bucket policy to grant the administrator's IAM user the s3:ReplicateObject permission.

Answer

Add the iam:PassRole permission for the S3ReplicationServiceRole to the administrator's IAM user policy.
To configure S3 replication, the IAM entity (user or role) executing the configuration API call must have the iam:PassRole permission for the replication role. This allows the user to delegate the role to S3. Even with AmazonS3FullAccess, the user cannot pass the IAM role without this specific permission, resulting in an AccessDenied error.

Step-by-Step Solution

1
Analyze the IAM configuration context and the AccessDenied error.
The command fails when associating the IAM role with the bucket replication configuration, despite the user having full S3 permissions.
AWS services require a user to have the iam:PassRole permission to pass an IAM role to the service, which is checked during configuration association.
2
Verify S3 replication prerequisite states.
Versioning is enabled on both source and destination buckets, and the IAM replication role is correctly configured to trust the S3 service principal.
This rules out basic configuration issues like versioning omission or incorrect service trust relationships.
3
Formulate the required permission update for the administrator's user policy.
Add an inline or customer-managed policy to the user allowing the iam:PassRole action with the resource pointing to the replication role's ARN.
This authorizes the administrator to delegate the role to Amazon S3, allowing the CLI command to succeed.

Key Concept

IAM PassRole requirement for AWS service role delegation
Rate this question

Topics

S3 Reliability and Replication

More questions from this topic