Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an AWS Database Migration Service (DMS) replication task to migrate database schemas to Amazon S3. The administrator creates a custom IAM role named DMSS3AccessRole to provide the required write access to the target S3 bucket. When the administrator attempts to save the DMS target endpoint with this role attached, the AWS Management Console displays an 'Access Denied' error. Which combination of actions must the SysOps administrator take to resolve this issue? (Select TWO.)

  1. Add a policy statement to the administrator's IAM policy that allows the iam:PassRole action on the DMSS3AccessRole resource.Answer
  2. Update the trust policy of the DMSS3AccessRole role to allow the dms.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  3. C
    Add a policy statement to the administrator's IAM policy that allows the sts:AssumeRole action on the DMSS3AccessRole resource.
  4. D
    Update the trust policy of the DMSS3AccessRole role to allow the administrator's IAM identity to perform the iam:PassRole action.
  5. E
    Add a policy statement to the administrator's IAM policy that allows the iam:PassRole action on the dms.amazonaws.com service principal.

Answer

Add a policy statement to the administrator's IAM policy that allows the iam:PassRole action on the DMSS3AccessRole resource, and update the trust policy of the DMSS3AccessRole role to allow the dms.amazonaws.com service principal to perform the sts:AssumeRole action.
To successfully delegate permissions to AWS DMS, two configurations are required. First, the administrator must have permission to delegate the role. This is done by adding iam:PassRole on the DMSS3AccessRole resource to the administrator's policy. Second, AWS DMS must be authorized to assume the role. This is achieved by updating the trust policy of the role to allow the dms.amazonaws.com service principal to execute sts:AssumeRole.

Step-by-Step Solution

1
Determine why the 'Access Denied' error occurs when attaching the role to the endpoint.
The AWS DMS service must be trusted to assume the role, and the administrator must be authorized to pass the role.
AWS security requires explicit permission delegation when services perform actions on behalf of a user.
2
Grant the administrator permission to pass the custom role to the DMS service.
An identity-based policy statement allowing 'iam:PassRole' on the role's resource is attached to the administrator.
This satisfies the verification check when the administrator submits the role to the DMS service endpoint configuration.
3
Establish trust between the IAM role and the AWS DMS service.
The trust relationship of the role is updated with a principal block for 'dms.amazonaws.com' allowing 'sts:AssumeRole'.
This allows the DMS service container to call STS to obtain temporary security credentials associated with the role.

Key Concept

IAM Role Delegation and Service Authorization using iam:PassRole and sts:AssumeRole
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic