A SysOps administrator is deploying a containerized application to Amazon Elastic Container Service (Amazon ECS). The application tasks must read messages from an Amazon SQS queue. The administrator creates an IAM role for the tasks but receives an authorization error when attempting to run the task using this role.
Which of the following configurations are required to resolve this issue? (Select TWO.)
- Modify the trust relationship of the IAM role to allow the Amazon ECS tasks service principal to perform the AssumeRole action.Answer
- Attach a permissions policy to the SysOps administrator's IAM identity that allows the PassRole action on the IAM role.Answer
- CAttach a permissions policy to the SysOps administrator's IAM identity that allows the AssumeRole action on the IAM role.
- DModify the trust relationship of the IAM role to allow the Amazon SQS service principal to perform the PassRole action.
Answer
To resolve the authorization error, the SysOps administrator must modify the trust relationship of the IAM role to allow the Amazon ECS tasks service principal to perform the AssumeRole action, and attach a permissions policy to the administrator's IAM identity that allows the PassRole action on the IAM role.
The correct configurations involve allowing the ECS task service principal to assume the role by modifying the role's trust relationship, and granting the administrator the PassRole permission to authorize them to pass the role to the ECS tasks.
Step-by-Step Solution
Key Concept
Delegating IAM roles to AWS services requires configuring both a trust relationship on the role and PassRole permissions on the deploying identity.