A developer is setting up an application on an on-premises server that must archive daily transaction logs to a private Amazon S3 bucket. To implement this securely without storing long-term credentials on the server, the developer creates an IAM User named `archive-agent` in the AWS account `111122223333` and an IAM Role named `S3UploaderRole` that has permissions to write to the S3 bucket. The application will authenticate as `archive-agent` using short-term configurations and then assume `S3UploaderRole` to perform the S3 uploads.
Which two configuration policies are required to establish this role-assumption trust relationship and grant the necessary permissions? (Select two.)
- A trust policy attached to S3UploaderRole that allows the archive-agent user to assume the role:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:user/archive-agent"
},
"Action": "sts:AssumeRole"
}
]
}
Cevap - A permissions policy attached to the archive-agent user that permits calling sts:AssumeRole on the role:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::111122223333:role/S3UploaderRole"
}
]
}
Cevap - CA trust policy attached to S3UploaderRole containing S3 permissions directly:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:user/archive-agent"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::company-logs-bucket/*"
}
]
} - DA permissions policy attached to S3UploaderRole that references the user as a resource:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::111122223333:user/archive-agent"
}
]
} - EA local credentials file containing static credentials for the AWS Account Root User to bypass role assumption:
{
"aws_access_key_id": "AKIAIOSFODNN7EXAMPLE",
"aws_secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
}
Cevap
To establish the trust relationship and grant permissions, the developer must attach a trust policy to the S3UploaderRole that lists the archive-agent user as the trusted principal allowed to perform the sts:AssumeRole action, and attach an IAM permissions policy to the archive-agent user that permits calling sts:AssumeRole on the role's Amazon Resource Name (ARN).
Role assumption is a two-way handshake. The trust policy attached to the S3UploaderRole must declare the archive-agent IAM User as a trusted principal that is permitted to execute the sts:AssumeRole action. Simultaneously, the archive-agent user must possess a permissions policy that explicitly permits it to perform the sts:AssumeRole action against the target role's ARN. This combination ensures that the user is authorized to request the role and the role is authorized to trust the user.
Adım Adım Çözüm
Anahtar Kavram
Role assumption requires permissions configured on both sides: a trust policy on the role defining who can assume it, and an identity permissions policy on the user permitting the assume role action.