An organization manages its multi-account environment using AWS Organizations. A SysOps ad… — AWS Certified SysOps Administrator - Associate

An organization manages its multi-account environment using AWS Organizations. A SysOps administrator is configuring a deployment script on an Amazon EC2 instance in member Account A ( $123456789012$ ). The EC2 instance is associated with an IAM instance profile that uses a role named `DeployerRole`.

The deployment script must launch new EC2 instances for an application tier and associate them with an existing IAM role named `ApplicationRole` in the same account. The administrator has attached the following IAM policy to the `DeployerRole`:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EC2RunInstances",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": "*"
},
{
"Sid": "AssumeApplicationRole",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::123456789012:role/ApplicationRole"
}
]
}

At the organization root, a Service Control Policy (SCP) is attached that includes the following statement to prevent unauthorized IAM modifications:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EnforceIAMGuardrails",
"Effect": "Deny",
"Action": [
"iam:Create*",
"iam:Delete*",
"iam:Update*"
],
"Resource": "*"
}
]
}

When the script executes, the attempt to launch the new EC2 instances fails with an `UnauthorizedOperation` error. Which action must the SysOps administrator take to resolve this issue and allow the script to successfully launch the instances?

Modify the IAM policy attached to DeployerRole by replacing the 'AssumeApplicationRole' statement with a statement that allows the 'iam:PassRole' action on 'arn:aws:iam::123456789012:role/ApplicationRole'.Cevap
B
Modify the trust policy of ApplicationRole to add the ARN of DeployerRole as a trusted principal, enabling DeployerRole to perform the 'sts:AssumeRole' action.
C
Modify the trust policy of DeployerRole to allow the EC2 service principal ('ec2.amazonaws.com') to assume it, allowing the service to delegate permissions.
D
Modify the SCP at the organization root to replace the deny statement for 'iam:Create*' with a statement that explicitly excludes 'iam:CreateInstanceProfile' via a NotAction element.

Cevap

Modify the IAM policy attached to DeployerRole by replacing the 'AssumeApplicationRole' statement with a statement that allows the 'iam:PassRole' action on 'arn:aws:iam::123456789012:role/ApplicationRole'.

The correct answer is to replace the 'AssumeApplicationRole' statement in the DeployerRole policy with one that allows 'iam:PassRole' on the ApplicationRole resource. When launching an EC2 instance with an associated IAM role, the launching principal does not assume the role directly. Instead, it passes the role to the EC2 service, which then assumes the role on the instance's behalf. This action is governed by the 'iam:PassRole' permission. The attached SCP does not block the operation since 'iam:PassRole' does not match the 'iam:Create*', 'iam:Delete*', or 'iam:Update*' patterns restricted by the SCP.

Adım Adım Çözüm

Analyze the IAM policy attached to the DeployerRole principal.

The current policy contains permissions to run EC2 instances and perform the 'sts:AssumeRole' action on the ApplicationRole resource, but lacks 'iam:PassRole'.

To launch an EC2 instance with an associated IAM role, the calling principal does not assume the role itself. Instead, the principal must have permission to pass the role to the AWS service (EC2) that will assume it.

Evaluate the Service Control Policy (SCP) attached to the Organizational Unit.

The SCP denies 'iam:Create*', 'iam:Delete*', and 'iam:Update*'. It does not contain a deny rule matching 'iam:PassRole'.

This confirms that the organization-level guardrails are not blocking the required role delegation action, pointing the issue directly to the lack of 'iam:PassRole' in the local policy.

Select the correct permission action to resolve the UnauthorizedOperation failure.

Determine that the policy must be updated to replace the 'sts:AssumeRole' action with 'iam:PassRole' for the ApplicationRole ARN.

Adding 'iam:PassRole' satisfies the authorization requirements of the ec2:RunInstances action when referencing a target IAM instance profile.

Anahtar Kavram

IAM role delegation via iam:PassRole versus role assumption via sts:AssumeRole, evaluated alongside SCP scope filters.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru