A SysOps administrator is using Amazon S3 Batch Operations to copy a large volume of objects from a source S3 bucket to a destination S3 bucket. The administrator creates an IAM role named S3BatchCopyRole to allow S3 Batch Operations to perform the copy on their behalf. The trust policy of S3BatchCopyRole is configured to allow the batchoperations.s3.amazonaws.com service principal to assume the role. However, when the administrator attempts to create the S3 Batch Operations job and specifies S3BatchCopyRole, the operation fails with an Access Denied error. The administrator's IAM user already has an attached policy granting full permissions to S3 (s3:*). Which action must be taken to successfully create the S3 Batch Operations job?
- Add a policy statement to the administrator's IAM user policy that allows the iam:PassRole action on the S3BatchCopyRole resource.Cevap
- BAdd a policy statement to the administrator's IAM user policy that allows the sts:AssumeRole action on the S3BatchCopyRole resource.
- CAdd a policy statement to the administrator's IAM user policy that allows kms:Decrypt and kms:GenerateDataKey for the KMS key used to encrypt the S3 buckets.
- DEnable bucket versioning on both the source and destination Amazon S3 buckets before creating the S3 Batch Operations job.
Cevap
Add a policy statement to the administrator's IAM user policy that allows the iam:PassRole action on the S3BatchCopyRole resource.
The correct action is to grant the administrator the iam:PassRole permission on the S3BatchCopyRole resource. When creating resources or jobs that run using a service role, AWS requires the initiating user to have permission to delegate (pass) that role to the service, preventing unauthorized privilege escalation.
Adım Adım Çözüm
Anahtar Kavram
IAM PassRole Permission