A SysOps administrator is configuring a daily backup plan in AWS Backup to protect Amazon RDS databases. The administrator wants to use a custom IAM role to execute the backup jobs. Which of the following configuration steps are required to allow AWS Backup to run the backup jobs using this custom role? (Select TWO.)
- A trust policy on the custom IAM role that allows the backup.amazonaws.com service principal to perform the sts:AssumeRole actionAnswer
- BAn IAM permissions policy attached to the custom IAM role that grants the iam:PassRole permission to the backup.amazonaws.com service
- An IAM policy attached to the administrator's IAM identity that grants the iam:PassRole permission for the custom IAM roleAnswer
- DAn IAM policy attached to the administrator's IAM identity that grants the sts:AssumeRole permission on the backup.amazonaws.com service
Answer
The correct configurations are: a trust policy on the custom IAM role allowing the backup service to assume it, and an IAM policy on the administrator's identity allowing the role to be passed.
To delegate permissions to an AWS service like AWS Backup, the service needs a trust policy allowing it to assume the role via sts:AssumeRole. Additionally, the administrator configuring the service must have the iam:PassRole permission to safely associate that role with the service.
Step-by-Step Solution
Key Concept
Delegating permissions to AWS services using trust relationships and PassRole authorization
Estimated Time:1m 0s