A SysOps administrator is configuring an AWS Database Migration Service (DMS) replication task to migrate data to an Amazon S3 target bucket. The administrator creates an IAM role named dms-s3-role to grant AWS DMS permissions to write to the S3 bucket. The trust policy of the role is configured to trust the DMS service principal. However, when the administrator attempts to create the S3 endpoint using the AWS Management Console and associates the dms-s3-role with it, the operation fails with an Access Denied error.
Which of the following actions must the SysOps administrator perform to successfully associate the IAM role with the endpoint? (Select TWO.)
- Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the dms-s3-role resource.Answer
- Ensure that the trust policy of the dms-s3-role allows the dms.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
- CAttach an IAM policy to the administrator's IAM identity that grants the sts:AssumeRole permission for the dms-s3-role resource.
- DModify the trust policy of the dms-s3-role to allow the administrator's IAM identity to perform the sts:AssumeRole action.
Answer
To resolve the Access Denied error, the SysOps administrator must attach an IAM policy to their own identity granting iam:PassRole permission on the target role, and ensure the target role's trust policy permits the dms.amazonaws.com service principal to assume it.
To successfully configure an AWS service to act on your behalf, two conditions must be met: the user configuring the service must have the iam:PassRole permission for the target role, and the role's trust policy must allow the service principal (dms.amazonaws.com) to assume the role via the sts:AssumeRole action.
Step-by-Step Solution
Key Concept
Delegating permissions to AWS services requires the user to have iam:PassRole permission and the service role to trust the specific AWS service principal.