Examkin

Soru

Zorluk: KolayVPC Security Controls and Traffic Analysis

A SysOps Administrator is setting up flow logs for a VPC to deliver network traffic logs to an Amazon CloudWatch Logs log group. The administrator has created a destination log group and has configured an IAM role designed for VPC Flow Logs. When the administrator tries to create the VPC Flow Log, the action fails with an access denied error. Which action will resolve this issue?

  1. A
    Modify the trust relationship on the flow logs IAM role to allow the administrator's IAM user to assume the role.
  2. Add a policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the flow logs IAM role.Cevap
  3. C
    Change the CloudWatch Logs log group retention settings to ensure log streams are not immediately archived.
  4. D
    Associate the subnets containing the EC2 instances with a route table that has a route to a Gateway VPC Endpoint for CloudWatch Logs.

Cevap

Add a policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the flow logs IAM role.
When a SysOps Administrator creates a VPC Flow Log that publishes to CloudWatch Logs, the Flow Logs service must act on behalf of the user. To delegate this authority, the administrator passes an IAM service role to the VPC Flow Logs service. AWS requires the administrator's IAM user or role to have the `iam:PassRole` permission for that specific service role to prevent unauthorized escalation of privilege.

Adım Adım Çözüm

1
Analyze the permission failure when enabling the VPC Flow Logs destination.
Identify that the administrator's current policy does not permit passing the configuration role to the VPC Flow Logs service.
Creating a resource that utilizes a service role requires authorization to delegate that role.
2
Attach a policy with the `iam:PassRole` action targeting the Flow Logs role ARN to the administrator's IAM user or group.
The console session successfully validates that the administrator has the authority to pass the IAM role.
This satisfies the AWS security boundary that prevents users from configuring services with roles they are not authorized to use.

Anahtar Kavram

Configuring VPC Flow Logs requires the administrator to have the `iam:PassRole` permission on the IAM role passed to the service.
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru