Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is configuring a third-party SaaS monitoring application to collect performance metrics from Amazon EC2 instances in their AWS account. The SaaS vendor's application runs in AWS account 123456789012. The vendor requires a secure delegation mechanism using an external ID value of VendorTokenXYZ.

The developer creates an IAM role named SaaSMonitoringRole with the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}

And attaches the following permissions policy to the role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*",
"Condition": {
"StringEquals": {
"sts:ExternalId": "VendorTokenXYZ"
}
}
}
]
}

However, the third-party application is unable to retrieve the EC2 metrics. Which of the following changes will resolve the authorization issue and follow security best practices?

  1. Move the sts:ExternalId condition block from the permissions policy to the condition block of the trust policy.Cevap
  2. B
    Add the Principal element directly to the permissions policy and declare the third-party AWS account ID within it.
  3. C
    Modify the trust policy to change the allowed action from sts:AssumeRole to sts:AssumeRoleWithWebIdentity.
  4. D
    Create an IAM user with administrative permissions, generate access keys, and configure the third-party application to use these long-term credentials.

Cevap

Move the sts:ExternalId condition block from the permissions policy to the condition block of the trust policy.
The correct action is to move the sts:ExternalId condition block from the permissions policy to the trust policy of the IAM role. The sts:ExternalId context key is only populated during the AssumeRole operation handled by AWS STS. Once the role is assumed and the caller makes subsequent calls to Amazon EC2, the sts:ExternalId context key is no longer available, causing any policy checking this context key during EC2 operations to fail. Evaluating it in the trust policy ensures that the external ID is verified at the moment of role assumption.

Adım Adım Çözüm

1
Analyze the IAM policies to identify where the sts:ExternalId condition is evaluated.
The sts:ExternalId context key is currently placed inside the identity-based permissions policy attached to the role.
This is incorrect because sts:ExternalId is only present in the request context during the sts:AssumeRole API call, not during subsequent calls to services like Amazon EC2.
2
Determine the proper location for the sts:ExternalId condition.
The condition must be placed within the trust policy of the IAM role.
The trust policy governs who can call sts:AssumeRole to obtain temporary credentials for the role. Placing the condition here allows AWS STS to validate the External ID when the SaaS application attempts to assume the role.
3
Modify the policies to follow standard security practices.
The permissions policy is updated to allow ec2:Describe* without the sts:ExternalId condition, and the trust policy is updated to include the Condition block checking the External ID.
This ensures successful role assumption and resource authorization while protecting against the confused deputy problem.

Anahtar Kavram

IAM trust policies vs permissions policies and the usage of External ID during AssumeRole operations
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru