Examkin

Soru

Zorluk: OrtaAWS Budgets and Cost Alerts

A SysOps administrator is configuring a monthly cost budget in AWS Budgets for a sandbox account. The administrator wants to configure an AWS Budgets Action that automatically attaches a restrictive IAM policy to prevent further resource creation when actual spending exceeds 5,0005,000. Which of the following configurations are required to allow AWS Budgets to successfully execute this action? (Select TWO.)

  1. An IAM execution role with a trust policy that allows the budgets.amazonaws.com service principal to assume the roleCevap
  2. The iam:PassRole permission granted to the IAM identity that is creating the budgetCevap
  3. C
    An IAM execution role with a trust policy that allows the billing.amazonaws.com service principal to assume the role
  4. D
    An AWS Cost Anomaly Detection monitor configured to trigger the target IAM role when the budget threshold is crossed
  5. E
    Cost allocation tags enabled in the billing console for the resources targeted by the IAM policy

Cevap

The configuration requires creating an IAM execution role that trusts the budgets.amazonaws.com service principal, and granting the iam:PassRole permission to the IAM user or role creating the budget.
The correct options require establishing a trust relationship with the budgets.amazonaws.com service principal on the execution role, and granting the iam:PassRole permission to the IAM identity configuring the budget. AWS Budgets assumes the execution role to perform the configured action, such as attaching a policy. The user setting up the budget must be authorized to pass this execution role to AWS Budgets.

Adım Adım Çözüm

1
Create an IAM role with a trust policy that allows the budgets.amazonaws.com service principal to assume it.
An IAM role is created that AWS Budgets can assume to perform operations.
AWS Budgets must assume this role to execute actions like attaching policies.
2
Grant the configuring administrator iam:PassRole permissions for the IAM role.
The administrator can associate the execution role with the budget action.
AWS prevents passing execution roles to services unless explicitly authorized via iam:PassRole.

Anahtar Kavram

AWS Budgets Actions permissions, including service trust relationships and the iam:PassRole permission.
Bu soruyu puanla

Konular

AWS Budgets and Cost Alerts

Bu konudan daha fazla soru