Examkin

Soru

Zorluk: KolayIAM Policies and Roles

A developer is deploying an application on an Amazon EC2 instance that needs to read data from an Amazon DynamoDB table. The developer creates an IAM role to grant the application the required permissions. The developer wants to configure the trust policy for this IAM role.

Consider the following trust policy document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "<PLACEHOLDER>"
},
"Action": "sts:AssumeRole"
}
]
}

To allow the EC2 instance to assume this IAM role, which value should replace `<PLACEHOLDER>`?

  1. ec2.amazonaws.comCevap
  2. B
    dynamodb.amazonaws.com
  3. C
    arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess
  4. D
    arn:aws:iam::123456789012:user/app-credentials

Cevap

ec2.amazonaws.com
The correct answer is the option specifying the EC2 service principal. An IAM role's trust policy defines the principals (users, roles, accounts, or services) that are allowed to assume the role. Since the application is running on an Amazon EC2 instance, the EC2 service itself must be trusted to assume the role on behalf of the instance. The service principal for EC2 is ec2.amazonaws.com.

Adım Adım Çözüm

1
Analyze the requirement of the application running on the Amazon EC2 instance.
The application runs on EC2 and needs to assume an IAM role to access DynamoDB.
Before the application can use the role, the EC2 service must be allowed to assume it.
2
Identify the purpose of a trust policy in an IAM role.
The trust policy determines which entity (Principal) is allowed to assume the role via the sts:AssumeRole action.
Only trusted entities defined in the trust policy can obtain temporary credentials for the role.
3
Determine the correct service principal for Amazon EC2.
The service principal for EC2 is ec2.amazonaws.com.
Replacing the placeholder with ec2.amazonaws.com successfully establishes trust with the EC2 service.

Anahtar Kavram

IAM role trust policies dictate which AWS services or identities can assume a role.
Tahmini Süre:45s
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru