Question

Difficulty: EasyIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring a daily backup plan in AWS Backup to protect Amazon RDS databases. The administrator wants to use a custom IAM role to execute the backup jobs. Which of the following configuration steps are required to allow AWS Backup to run the backup jobs using this custom role? (Select TWO.)

  1. A trust policy on the custom IAM role that allows the backup.amazonaws.com service principal to perform the sts:AssumeRole actionAnswer
  2. B
    An IAM permissions policy attached to the custom IAM role that grants the iam:PassRole permission to the backup.amazonaws.com service
  3. An IAM policy attached to the administrator's IAM identity that grants the iam:PassRole permission for the custom IAM roleAnswer
  4. D
    An IAM policy attached to the administrator's IAM identity that grants the sts:AssumeRole permission on the backup.amazonaws.com service

Answer

The correct configurations are: a trust policy on the custom IAM role allowing the backup service to assume it, and an IAM policy on the administrator's identity allowing the role to be passed.
To delegate permissions to an AWS service like AWS Backup, the service needs a trust policy allowing it to assume the role via sts:AssumeRole. Additionally, the administrator configuring the service must have the iam:PassRole permission to safely associate that role with the service.

Step-by-Step Solution

1
Configure the trust relationship on the custom IAM role to trust the AWS Backup service.
The custom IAM role trust policy permits the backup.amazonaws.com service principal to execute the sts:AssumeRole API action.
This allows the AWS Backup service to dynamically assume the role and inherit its permissions when running backup jobs.
2
Configure the administrator's permissions to allow passing the role to AWS Backup.
The administrator's IAM policy is updated with the iam:PassRole action targeting the ARN of the custom IAM role.
This ensures the administrator is authorized to delegate the specific IAM role to the service, preventing unauthorized role escalation.

Key Concept

Delegating permissions to AWS services using trust relationships and PassRole authorization
Estimated Time:1m 0s
Rate this question