Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an AWS Glue crawler to scan an Amazon S3 bucket. The administrator has created a custom IAM role named GlueCrawlerRole that has the required S3 read permissions and has configured AWS Glue as the trusted service in the trust policy. When the administrator attempts to create the crawler using the AWS Management Console and associates it with GlueCrawlerRole, the console displays an error: "Access Denied: You do not have permission to perform this action."

Which action must be taken to successfully create the crawler?

  1. Attach an IAM policy to the administrator's IAM user that grants iam:PassRole permissions for the GlueCrawlerRole ARN.Answer
  2. B
    Attach an IAM policy to the administrator's IAM user that grants sts:AssumeRole permissions for the GlueCrawlerRole ARN.
  3. C
    Edit the trust policy of GlueCrawlerRole to include the administrator's IAM user ARN as a trusted principal.
  4. D
    Edit the Amazon S3 bucket policy to grant s3:GetObject and s3:ListBucket permissions directly to the administrator's IAM user.

Answer

Attach an IAM policy to the administrator's IAM user that grants iam:PassRole permissions for the GlueCrawlerRole ARN.
The correct option is to attach an IAM policy to the administrator's IAM user that grants iam:PassRole permissions. When configuring AWS services to act on your behalf, you must have permission to pass the role to that service. The iam:PassRole permission checks if the user is authorized to associate the specific role with the service.

Step-by-Step Solution

1
Identify the context of the error.
The SysOps administrator is assigning an IAM role (GlueCrawlerRole) to an AWS service (AWS Glue) during resource configuration.
The error occurs at the time of crawler creation and role association, indicating a control plane permission issue rather than a runtime execution issue.
2
Determine the required IAM permission for associating a role with a service.
The administrator's IAM policy requires the iam:PassRole action.
AWS enforces the iam:PassRole permission to ensure that users cannot elevate their privileges by passing highly privileged roles to services they configure.
3
Verify service trust configuration.
The trust policy on GlueCrawlerRole is already configured correctly with AWS Glue as the trusted service.
AWS Glue needs to assume the role during execution, but the administrator first needs to pass it, which requires user-side permissions.

Key Concept

IAM PassRole permissions are required to associate an IAM role with an AWS service.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic