Examkin

Soru

Zorluk: ZorIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an Amazon EC2 Image Builder pipeline in Account A (123456789012123456789012) to build custom machine images. The pipeline is configured to run using an IAM role named `ImageBuilderPipelineExecutionRole`. During the build process, the pipeline launches an EC2 instance that must run with an IAM instance profile associated with the IAM role `ImageBuilderBuildRole`. When the pipeline is executed, it fails during the build phase with an Access Denied error when attempting to launch the EC2 build instance. The `ImageBuilderPipelineExecutionRole` permissions policy contains permissions for `imagebuilder:*` and `ec2:*` actions but does not contain any other permissions. Which modification to the IAM policies will resolve this error?

  1. A
    Add `sts:AssumeRole` permissions for the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.
  2. B
    Modify the trust policy of `ImageBuilderBuildRole` to allow the `ImageBuilderPipelineExecutionRole` to perform the `sts:AssumeRole` action.
  3. Add `iam:PassRole` permissions for the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.Cevap
  4. D
    Attach a policy to `ImageBuilderBuildRole` allowing it to perform the `sts:AssumeRole` action on the `ImageBuilderPipelineExecutionRole` resource.

Cevap

Add `iam:PassRole` permissions for the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.
To launch an Amazon EC2 instance with an IAM role associated, the principal launching the instance (in this case, the EC2 Image Builder pipeline execution role) must have `iam:PassRole` permissions on the role being passed to the instance (`ImageBuilderBuildRole`). This allows the pipeline to safely delegate the role to the EC2 service for the build instance.

Adım Adım Çözüm

1
Identify the failing action.
The EC2 Image Builder pipeline fails during the build phase while attempting to launch an EC2 instance associated with the `ImageBuilderBuildRole` role.
This indicates that the identity launching the instance (the pipeline execution role) lacks the authority to delegate the target role to the EC2 instance.
2
Determine the required IAM permission for role delegation.
The `iam:PassRole` permission is required.
When an AWS service or service role launches a resource with an IAM role attached, the calling principal must have the explicit permission to pass that role to the service.
3
Update the execution role policy.
Add `iam:PassRole` on the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.
This grants the pipeline execution role the necessary permissions to successfully pass the build role to the EC2 service during the instance launch.

Anahtar Kavram

IAM Role Delegation and the PassRole Permission
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

IAM Policies, Roles, and Service Control Policies (SCPs)

Bu konudan daha fazla soru