A company's SysOps team is setting up AWS Backup to centralize backup management. A SysOps administrator is configuring a backup plan that must use a custom IAM service role to back up Amazon RDS instances. The administrator needs to grant the AWS Backup service the permissions to assume this role, and also ensure that the administrator has the permissions required to assign this role to the backup plan. Which two configuration steps must be performed to meet these requirements?
- Configure the trust policy of the IAM role to allow the backup.amazonaws.com service principal to perform the sts:AssumeRole action.Cevap
- Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the IAM role's Amazon Resource Name (ARN).Cevap
- CAttach an IAM policy to the administrator's IAM identity that grants the sts:AssumeRole permission for the IAM role's Amazon Resource Name (ARN).
- DConfigure the trust policy of the IAM role to allow the administrator's IAM identity to perform the iam:PassRole action.
Cevap
To establish this access, the trust policy of the IAM role must allow the AWS Backup service principal to perform the sts:AssumeRole action, and the administrator's identity must be granted the iam:PassRole permission for the role's ARN.
To delegate permissions to an AWS service, two parts are required: the service itself must be trusted to assume the role, and the user setting up the configuration must have permission to pass the role to the service. The service trust is established via the trust policy using the sts:AssumeRole action, and user permission to delegate the role is granted via the identity-based policy using the iam:PassRole permission.
Adım Adım Çözüm
Anahtar Kavram
Delegating permissions to AWS services using service trust policies and iam:PassRole.