Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring a Python script hosted on an Amazon EC2 instance in Account A (111111111111111111111111) to automate the provisioning of temporary worker instances. The script uses the AWS SDK to call the `RunInstances` API and associates the new instances with an IAM instance profile that contains an IAM role named `WorkerExecutionRole`.

The EC2 instance running the script is associated with an IAM role named `AutomationAdminRole` which has the following IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:DescribeInstances"
],
"Resource": "*"
}
]
}

When the script execution is triggered, it fails with an `UnauthorizedOperation` error during instance launch.

Which modification to the IAM configuration of `AutomationAdminRole` is required to resolve this error?

  1. Add a statement to the IAM policy of AutomationAdminRole that allows the iam:PassRole action on the WorkerExecutionRole resource.Answer
  2. B
    Modify the trust policy of the WorkerExecutionRole to allow the AutomationAdminRole to perform the sts:AssumeRole action.
  3. C
    Modify the trust policy of the AutomationAdminRole to allow the ec2.amazonaws.com service principal to perform the sts:AssumeRole action.
  4. D
    Add a statement to the IAM policy of AutomationAdminRole that allows the iam:PassRole action on the WorkerInstanceProfile resource.

Answer

Add a statement to the IAM policy of AutomationAdminRole that allows the iam:PassRole action on the WorkerExecutionRole resource.
The correct action is to add the iam:PassRole permission to the policy of the calling role (AutomationAdminRole) targeting the IAM role resource (WorkerExecutionRole). This allows the script running under AutomationAdminRole to associate WorkerExecutionRole with the new EC2 instances during the RunInstances API call.

Step-by-Step Solution

1
Analyze the IAM identities involved in the script execution.
The script runs under the AutomationAdminRole identity and attempts to associate a new EC2 instance with the WorkerExecutionRole.
Identifying the active identity and the target role resource determines where the permission must be applied.
2
Identify the root cause of the provisioning error.
The script attempts to pass the WorkerExecutionRole to the EC2 service during the RunInstances call, which requires the iam:PassRole permission.
AWS requires explicit permission to pass an IAM role to an AWS service to prevent unauthorized privilege escalation.
3
Update the execution role's permissions policy.
Modify the policy attached to AutomationAdminRole to include the iam:PassRole action targeting the WorkerExecutionRole's Amazon Resource Name (ARN).
This satisfies the authorization check performed when the RunInstances call attempts to assign the role.

Key Concept

Using iam:PassRole to delegate permissions to AWS resources via service roles and instance profiles.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic