A developer is configuring a local application to access an Amazon DynamoDB table in an AWS account. To comply with security best practices, the application must run locally by assuming an IAM role named DbAccessRole using temporary credentials. The developer has a local AWS CLI profile named dev-user configured with IAM user credentials.
Which two actions must the developer take to configure the application to assume the role?
- Define a new profile in the local ~/.aws/config file, specifying the role_arn of DbAccessRole and setting the source_profile to dev-user.Cevap
- Configure the trust policy of DbAccessRole to allow the sts:AssumeRole action for the ARN of the dev-user IAM user.Cevap
- CHardcode the IAM user's Access Key ID and Secret Access Key directly into the application's SDK client configuration to programmatically call sts:AssumeRole.
- DAttach an IAM permissions policy to DbAccessRole that specifies the IAM user as the Principal and grants the sts:AssumeRole action.
- EModify the trust policy of the dev-user IAM user to allow it to assume the DbAccessRole IAM role.
Cevap
Define a new profile in the local ~/.aws/config file, specifying the role_arn of DbAccessRole and setting the source_profile to dev-user. Also, configure the trust policy of DbAccessRole to allow the sts:AssumeRole action for the ARN of the dev-user IAM user.
The correct configuration requires both configuring the target role to trust the specific IAM user, and setting up the local CLI configuration to chain the profiles. Specifying the role_arn and source_profile in ~/.aws/config tells the AWS SDK or CLI to use the credentials from the source profile to call sts:AssumeRole for the target role. The target role's trust policy must list the IAM user as a principal and allow the sts:AssumeRole action.
Adım Adım Çözüm
Anahtar Kavram
IAM role assumption requires a trust policy specifying the trusted principal, and client applications can use profile chaining in the local configuration to automatically retrieve temporary credentials.