Soru

Zorluk: OrtaIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is using Amazon S3 Batch Operations to copy a large volume of objects from a source S3 bucket to a destination S3 bucket. The administrator creates an IAM role named S3BatchCopyRole to allow S3 Batch Operations to perform the copy on their behalf. The trust policy of S3BatchCopyRole is configured to allow the batchoperations.s3.amazonaws.com service principal to assume the role. However, when the administrator attempts to create the S3 Batch Operations job and specifies S3BatchCopyRole, the operation fails with an Access Denied error. The administrator's IAM user already has an attached policy granting full permissions to S3 (s3:*). Which action must be taken to successfully create the S3 Batch Operations job?

  1. Add a policy statement to the administrator's IAM user policy that allows the iam:PassRole action on the S3BatchCopyRole resource.Cevap
  2. B
    Add a policy statement to the administrator's IAM user policy that allows the sts:AssumeRole action on the S3BatchCopyRole resource.
  3. C
    Add a policy statement to the administrator's IAM user policy that allows kms:Decrypt and kms:GenerateDataKey for the KMS key used to encrypt the S3 buckets.
  4. D
    Enable bucket versioning on both the source and destination Amazon S3 buckets before creating the S3 Batch Operations job.

Cevap

Add a policy statement to the administrator's IAM user policy that allows the iam:PassRole action on the S3BatchCopyRole resource.
The correct action is to grant the administrator the iam:PassRole permission on the S3BatchCopyRole resource. When creating resources or jobs that run using a service role, AWS requires the initiating user to have permission to delegate (pass) that role to the service, preventing unauthorized privilege escalation.

Adım Adım Çözüm

1
Analyze the error context and identify the workflow.
An administrator is attempting to pass a service role (S3BatchCopyRole) to S3 Batch Operations to execute actions on their behalf.
When configuring AWS services to act on behalf of a user, the user's IAM identity must possess permission to pass the role.
2
Differentiate between iam:PassRole and sts:AssumeRole permissions.
The service principal (batchoperations.s3.amazonaws.com) requires sts:AssumeRole (configured in the role's trust policy), whereas the user configuring the service job requires iam:PassRole.
This prevents unauthorized users from configuring services with highly privileged roles that they themselves do not have access to.
3
Determine the necessary policy addition for the administrator.
Add an IAM policy granting 'iam:PassRole' on the target ARN of S3BatchCopyRole to the administrator's IAM user or group.
This permits the administrator to associate the role with the S3 Batch Operations job, resolving the Access Denied error.

Anahtar Kavram

IAM PassRole Permission
Bu soruyu puanla