Examkin

Soru

Zorluk: OrtaIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an Amazon EC2 Auto Scaling group to use a new launch template. The launch template specifies an IAM instance profile associated with an IAM role named 'ApplicationServerRole'. When the administrator attempts to create the launch template, the action fails with an 'Access Denied' error. The administrator already has full administrative access to Amazon EC2, but their IAM permissions are restricted. Which permission must be added to the administrator's IAM policy to resolve this issue?

  1. Allow the iam:PassRole action on the ApplicationServerRole resource in the administrator's IAM policy.Cevap
  2. B
    Allow the sts:AssumeRole action on the ApplicationServerRole resource in the administrator's IAM policy.
  3. C
    Modify the trust policy of the ApplicationServerRole to allow the administrator's IAM user to assume the role.
  4. D
    Allow the iam:AssociateInstanceProfile action on the Auto Scaling group resource in the administrator's IAM policy.

Cevap

Allow the iam:PassRole action on the ApplicationServerRole resource in the administrator's IAM policy.
The correct answer is correct because the iam:PassRole action is specifically designed to control which roles a user can assign to AWS services (like EC2). When creating resources like launch templates that specify service roles, the user's IAM policy must grant permission to pass that role to the service.

Adım Adım Çözüm

1
Analyze the error context.
The error is 'Access Denied' occurring during the creation of an EC2 launch template that references an IAM instance profile.
Creating a launch template with an instance profile requires the creator to delegate permissions to the service.
2
Determine the required API permission for delegation.
Identify the iam:PassRole permission as the mandatory authorization needed to pass an IAM role to an AWS service.
AWS prevents privilege escalation by requiring that a user must have explicit permission to assign a role to a service.
3
Select the option that resolves the permission gap.
Grant the iam:PassRole action on the ApplicationServerRole resource in the administrator's policy.
This allows the administrator to pass the ApplicationServerRole to the EC2 service via the launch template.

Anahtar Kavram

IAM Role Delegation and the iam:PassRole Permission
Bu soruyu puanla

Konular

IAM Policies, Roles, and Service Control Policies (SCPs)

Bu konudan daha fazla soru