Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is setting up an Amazon EventBridge rule to route custom application events to an Amazon Kinesis Data Firehose delivery stream. The developer creates an IAM role named `EventBridgeToFirehoseRole` to allow EventBridge to put records into the delivery stream. The IAM role has the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

The permissions policy attached to the role is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"firehose:PutRecord",
"firehose:PutRecordBatch"
],
"Resource": "arn:aws:firehose:us-east-1:123456789012:deliverystream/my-stream"
}
]
}

However, when events are triggered, EventBridge fails to send the events to the delivery stream. Which of the following changes will resolve this issue?

  1. A
    Update the permissions policy to allow the sts:AssumeRole action on the EventBridge rule resource.
  2. B
    Configure the application's SDK client to generate temporary credentials using STS and pass them directly within the EventBridge event payload.
  3. Update the IAM role trust policy to list events.amazonaws.com as the service principal instead of firehose.amazonaws.com.Cevap
  4. D
    Create an identity-based policy for the EventBridge service principal that allows it to assume the role, and delete the trust policy.

Cevap

Update the IAM role trust policy to list events.amazonaws.com as the service principal instead of firehose.amazonaws.com.
The correct option is to update the trust policy because Amazon EventBridge is the service initiating the action and needs to assume the IAM role to put records into the Kinesis Data Firehose delivery stream. The trust policy governs which security principal is allowed to assume the role. Listing firehose.amazonaws.com in the trust policy is a common mistake that incorrectly trusts the destination service instead of the invoking service.

Adım Adım Çözüm

1
Identify which AWS service principal needs to assume the role to perform the action.
Amazon EventBridge (events.amazonaws.com) is the service triggering the rule and needs to write to the Firehose delivery stream.
The service invoking the target must be the one granted permission to assume the execution role.
2
Inspect the role's trust policy to verify the trusted entity.
The current trust policy lists firehose.amazonaws.com as the trusted entity.
A misconfigured trust policy will prevent the calling service (EventBridge) from assuming the role to perform downstream tasks.
3
Modify the trust policy to trust the correct calling service principal.
Change the principal service from firehose.amazonaws.com to events.amazonaws.com.
This allows EventBridge to assume the role and use the permissions granted in the permissions policy to write to Kinesis Firehose.

Anahtar Kavram

IAM Trust Policies vs. Permissions Policies
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru