Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is setting up an AWS Glue crawler to catalog data in an Amazon S3 bucket. The administrator creates an IAM role named GlueCrawlerRole that has the required permissions to access the S3 bucket. However, when the administrator attempts to run the crawler, the execution fails. The error logs indicate that the AWS Glue service is not authorized to assume the role, and the administrator is not authorized to associate the role with the crawler. Which of the following actions must the administrator take to successfully run the crawler? (Select TWO.)

  1. Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the GlueCrawlerRole resource.Answer
  2. Configure the trust relationship on GlueCrawlerRole to allow the glue.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  3. C
    Attach an IAM policy to the administrator's IAM identity that grants the sts:AssumeRole permission for the GlueCrawlerRole resource.
  4. D
    Configure the trust relationship on GlueCrawlerRole to allow the administrator's IAM identity to perform the sts:AssumeRole action.

Answer

Configure the trust relationship on the GlueCrawlerRole to allow the glue.amazonaws.com service principal to perform the sts:AssumeRole action, and attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the GlueCrawlerRole resource.
To successfully run the AWS Glue crawler, two permission configurations are required. First, the AWS Glue service itself must be allowed to assume the service role (GlueCrawlerRole). This is configured by adding a trust policy (trust relationship) to the role that lists the service principal glue.amazonaws.com and allows the sts:AssumeRole action. Second, the user or administrator who initiates the crawler must have permission to pass this role to the AWS Glue service. This is configured by attaching an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the specific role resource.

Step-by-Step Solution

1
Analyze the trust relationship error.
The service cannot assume the role.
For AWS Glue to execute tasks using the GlueCrawlerRole, the role's trust policy must list the Glue service principal (glue.amazonaws.com) as a trusted entity and allow the sts:AssumeRole action.
2
Analyze the role association error.
The administrator cannot associate the role.
When a user configures a service to run using a specific IAM role, AWS requires that the user have the iam:PassRole permission for that role to prevent privilege escalation.
3
Combine the required configurations.
Both the trust relationship and the user permissions must be correctly configured.
Configuring only one of these permissions will not resolve the entire access denied issue, so both steps are required.

Key Concept

Delegating permissions to AWS services requires configuring both a service trust policy (sts:AssumeRole) and user delegation permissions (iam:PassRole).
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic