A SysOps administrator is launching a new Amazon EC2 instance that must run an application that accesses an Amazon S3 bucket. An IAM role with the necessary S3 permissions has already been created. The administrator needs to configure the EC2 instance to run the application using this role.
Which two actions are required to successfully complete this configuration? (Select TWO.)
- Associate the IAM role with an instance profile, and attach the instance profile to the EC2 instance.Answer
- Ensure the administrator's IAM user identity is granted the iam:PassRole permission for the specific IAM role.Answer
- CEnsure the administrator's IAM user identity is granted the sts:AssumeRole permission for the specific IAM role.
- DUpdate the trust policy of the IAM role to allow the administrator's IAM user identity to assume the role.
Answer
The correct actions are associating the IAM role with an instance profile to attach it to the EC2 instance, and ensuring the administrator's IAM user identity has the iam:PassRole permission.
To configure an EC2 instance to run an application with specific IAM permissions, you must wrap the IAM role inside an instance profile and attach it to the EC2 instance. Furthermore, the administrator who performs this attachment must possess the iam:PassRole permission to authorize passing the role to the EC2 service.
Step-by-Step Solution
Key Concept
Delegating AWS permissions to EC2 instances using Instance Profiles and the iam:PassRole permission