Examkin

Soru

Zorluk: ZorAuto Scaling and Elasticity

A SysOps administrator is configuring an Auto Scaling group (ASG) to deploy EC2 instances using a new launch template. The launch template specifies an IAM instance profile associated with the IAM role 'AppExecutionRole'. During a scale-out event, the ASG fails to launch new instances. The ASG activity history shows the following error:

'Launching a new EC2 instance failed. Status Reason: User: arn:aws:iam::123456789012:user/SysOpsAdmin is not authorized to perform: iam:PassRole on resource: arn:aws:iam::123456789012:role/AppExecutionRole'

Which action must the administrator take to successfully launch the instances?

  1. Attach an IAM policy to the SysOpsAdmin user that grants the iam:PassRole permission for the AppExecutionRole resource.Cevap
  2. B
    Modify the trust policy of the AppExecutionRole to allow the autoscaling.amazonaws.com service principal to perform sts:AssumeRole.
  3. C
    Increase the default cooldown period of the Auto Scaling group to allow the IAM role propagation to complete before the next launch attempt.
  4. D
    Enable detailed monitoring in the launch template to reduce the time required for CloudWatch to verify the authorization status of the instance profile.

Cevap

Attach an IAM policy to the SysOpsAdmin user that grants the iam:PassRole permission for the AppExecutionRole resource.
The correct action is to attach an IAM policy to the SysOpsAdmin user that grants the iam:PassRole permission for the AppExecutionRole resource. This permission is required when a user creates or updates an Auto Scaling group with a launch template containing an IAM instance profile, ensuring the user is authorized to pass the role to the EC2 instances being launched.

Adım Adım Çözüm

1
Identify the cause of the failure from the activity history error message.
The message indicates that the user 'SysOpsAdmin' lacks the 'iam:PassRole' permission for the 'AppExecutionRole'.
When creating or updating an Auto Scaling group with a launch template that uses an IAM instance profile, AWS requires the calling user to have permission to pass that role to the EC2 service.
2
Create or modify an IAM policy for the SysOpsAdmin user.
An IAM policy is created containing the 'iam:PassRole' action targeted at the Amazon Resource Name (ARN) of the AppExecutionRole.
This policy explicitly authorizes the SysOpsAdmin user to delegate the role to EC2 instances launched under their configuration.
3
Apply the policy to the SysOpsAdmin IAM user or group.
The permission is applied, allowing subsequent scale-out actions by the Auto Scaling group to succeed.
Applying the policy resolves the unauthorized status reason, enabling the Auto Scaling service to successfully launch instances with the defined profile.

Anahtar Kavram

IAM PassRole Permission in Auto Scaling Launch Templates
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Auto Scaling and Elasticity

Bu konudan daha fazla soru