Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is configuring an AWS CodeBuild project in Account 111111111111111111111111 that must retrieve database configuration credentials from AWS Systems Manager Parameter Store in Account 222222222222222222222222. The developer creates an IAM role named CrossAccountParamReaderRole in Account 222222222222222222222222 with permission to read the parameters.

The CodeBuild project's service role in Account 111111111111111111111111 has permissions to assume CrossAccountParamReaderRole. However, during the build phase, the CodeBuild build fails with an AccessDenied error when executing the assume-role CLI command.

The trust policy for CrossAccountParamReaderRole in Account 222222222222222222222222 is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy in Account 222222222222222222222222 will resolve this issue?

  1. Update the Principal block of the trust policy to reference Account 111111111111111111111111 or the specific CodeBuild service role ARN instead of the CodeBuild service principal.Cevap
  2. B
    Add a Statement to the trust policy with the Action ssm:GetParameters and the Resource set to the parameter ARNs.
  3. C
    Add the CodeBuild service role ARN from Account 111111111111111111111111 to the Resource element in the statement of the trust policy.
  4. D
    Configure the buildspec.yml file to store the Access Key ID and Secret Access Key of an IAM user from Account 222222222222222222222222 directly in plain text environment variables.

Cevap

Update the Principal block of the trust policy to reference Account 111111111111111111111111 or the specific CodeBuild service role ARN instead of the CodeBuild service principal.
To allow an IAM identity (such as a role or user) from another AWS account to assume an IAM role, the target role's trust policy must specify that external account or the specific IAM identity as a trusted principal. The original trust policy only trusts the regional AWS CodeBuild service principal within the same account (Account 222222222222222222222222). Updating the Principal block to trust Account 111111111111111111111111 (or the specific CodeBuild service role in Account 111111111111111111111111) permits the STS AssumeRole request to succeed.

Adım Adım Çözüm

1
Identify the type of policy configuration error.
The current trust policy only trusts the regional 'codebuild.amazonaws.com' service within its own account (Account 222222222222222222222222).
For cross-account access, a trust policy must explicitly trust the external account or the specific identity attempting to assume the role.
2
Select the correct Principal modification.
Changing the Principal to target Account 111111111111111111111111 or the specific CodeBuild service role ARN allows the delegation of authority.
This establishes the trust boundary between the two AWS accounts so that sts:AssumeRole calls from Account 111111111111111111111111 are accepted.

Anahtar Kavram

IAM trust policies vs identity-based policies in cross-account access
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru