Examkin

Soru

Zorluk: OrtaAWS CloudTrail Configuration and Management

A SysOps Administrator is using the AWS CLI to configure an existing AWS CloudTrail trail to send log events to an Amazon CloudWatch Logs log group. The administrator has already created the target log group and an IAM role named CloudTrail-Delivery-Role that includes the required permissions for CloudWatch Logs. However, when running the aws cloudtrail update-trail command to associate the role and log group with the trail, the CLI returns an AccessDeniedException error.

Which action should the administrator take to resolve this error?

  1. A
    Modify the trust policy of the CloudTrail-Delivery-Role to trust the cloudtrail.amazonaws.com service principal and allow the sts:AssumeRole action.
  2. Attach an IAM policy to the administrator's IAM user that grants the iam:PassRole permission for the CloudTrail-Delivery-Role resource.Cevap
  3. C
    Add a statement to the S3 bucket policy of the logging bucket to allow cloudtrail.amazonaws.com to perform the sts:AssumeRole action.
  4. D
    Configure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation runbook to automatically grant CloudTrail access to the log group.

Cevap

Attach an IAM policy to the administrator's IAM user that grants the iam:PassRole permission for the CloudTrail-Delivery-Role resource.
To associate an IAM role with an AWS service (such as CloudTrail) via the AWS CLI or API, the IAM entity executing the configuration command must have the iam:PassRole permission for that specific role. If this permission is missing, the AWS API returns an AccessDeniedException during the setup configuration.

Adım Adım Çözüm

1
Analyze the error context: The AccessDeniedException occurs during the execution of the update-trail command, which is a configuration-time operation rather than a runtime log delivery failure.
The error must be resolved by granting permissions to the IAM identity executing the CLI command.
The CLI user must have authority to assign the IAM role to CloudTrail.
2
Identify the required IAM permission for role delegation: When configuring an AWS service to act on behalf of a user, the user must have the iam:PassRole permission.
Confirming that iam:PassRole is required for the role ARN.
This security measure prevents users from passing highly privileged roles to services to escalate their own permissions.
3
Formulate the correct IAM policy statement: Create an IAM policy allowing iam:PassRole on the CloudTrail-Delivery-Role ARN and attach it to the administrator's user or group.
The CLI command succeeds after the policy is applied.
Providing the necessary delegation permission allows the configuration call to be authorized.

Anahtar Kavram

IAM role delegation via iam:PassRole during CloudTrail CloudWatch Logs configuration
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS CloudTrail Configuration and Management

Bu konudan daha fazla soru