Examkin

Soru

Zorluk: ZorIAM Policies and Roles

A developer is configuring an Amazon API Gateway REST API to write execution logs to Amazon CloudWatch Logs. The developer creates an IAM role for API Gateway to assume and configures the following trust policy on the role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "apigateway.amazonaws.com"
},
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
}
]
}

However, when testing the API Gateway REST API, the developer notices that no execution logs are appearing in CloudWatch. How should the developer correct this configuration?

  1. Update the trust policy's Action to "sts:AssumeRole", and attach a separate IAM permissions policy to the role that grants the CloudWatch Logs actions.Cevap
  2. B
    Change the Service principal in the trust policy to "logs.amazonaws.com" to permit the CloudWatch Logs service to accept logs from API Gateway.
  3. C
    Add "sts:AssumeRole" to the Action array in the current trust policy to grant both role assumption and logging capabilities in a single statement.
  4. D
    Hardcode the AWS Access Key ID and Secret Access Key of an administrator IAM user inside the API Gateway integration's client code.

Cevap

Update the trust policy's Action to "sts:AssumeRole", and attach a separate IAM permissions policy to the role that grants the CloudWatch Logs actions.
The correct option is to update the trust policy's Action to "sts:AssumeRole" and attach a separate permissions policy to the role. In AWS IAM, a role has two types of policies: a trust policy (which defines which principal is trusted to assume the role) and a permissions policy (which defines what the identity assuming the role can do). A trust policy must specify "Action": "sts:AssumeRole". The functional permissions for CloudWatch Logs (such as logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents) must be attached to the role via an identity-based permissions policy, not specified in the trust policy.

Adım Adım Çözüm

1
Analyze the IAM role's trust policy.
The current trust policy specifies logging actions directly in the Action block of the trust relationship, which is invalid.
An IAM role's trust policy (trust relationship) is only used to define which principals can assume the role. The only action it should grant is 'sts:AssumeRole'.
2
Separate trust relationships from permissions policies.
Modify the trust policy's Action to 'sts:AssumeRole' for the service principal 'apigateway.amazonaws.com'. Create a separate IAM permissions policy containing 'logs:CreateLogGroup', 'logs:CreateLogStream', and 'logs:PutLogEvents', and attach it to the role.
This establishes a valid trust relationship allowing API Gateway to assume the role, and grants the assumed role the necessary permissions to write to CloudWatch Logs.

Anahtar Kavram

IAM Trust Policies vs. Permissions Policies
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru