Examkin

Soru

Zorluk: KolayIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is creating an Amazon Kinesis Data Firehose delivery stream that must write log data to an Amazon S3 bucket. The administrator has already created an IAM role with the necessary S3 permissions and a trust policy that allows Kinesis Firehose to assume the role. However, when the administrator attempts to create the delivery stream using this role, the operation fails with an authorization error.

Which IAM permission must be granted to the SysOps administrator's IAM policy to resolve this issue?

  1. A
    iam:AttachRolePolicy
  2. B
    sts:AssumeRole
  3. iam:PassRoleCevap
  4. D
    sts:GetSessionToken

Cevap

The permission that allows the administrator to pass the IAM role to the AWS service is iam:PassRole.
The correct answer is the permission that allows an administrator to pass an IAM role to an AWS service (such as Kinesis Data Firehose) so that the service can assume the role and perform actions on their behalf. The iam:PassRole permission must be explicitly granted in the administrator's IAM policy for this operation to succeed.

Adım Adım Çözüm

1
Identify the action causing the failure.
The SysOps administrator is attempting to associate an IAM role with Amazon Kinesis Data Firehose, which is a role delegation action.
When configuring AWS services to act on behalf of a user, the user must have permission to pass the role to the service.
2
Determine the required permission for role delegation.
The required permission is iam:PassRole, which must be added to the administrator's IAM policy.
This permission prevents users from passing highly privileged roles to services they should not configure.

Anahtar Kavram

Delegating IAM roles to AWS services requires the iam:PassRole permission on the user or role performing the configuration.
Tahmini Süre:45s
Bu soruyu puanla

Konular

IAM Policies, Roles, and Service Control Policies (SCPs)

Bu konudan daha fazla soru