Examkin

Soru

Zorluk: OrtaAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is configuring an AWS Systems Manager State Manager association to run a custom script on a fleet of target Amazon EC2 instances. The target instances have the SSM Agent installed and running, and they are configured with an IAM instance profile containing the AmazonSSMManagedInstanceCore policy. The administrator configures the association to use a custom service role named StateManagerExecutionRole to perform the operations. However, when the administrator attempts to create the association, the action fails with an "Access Denied" error. What is the most likely cause of this failure?

  1. A
    The trust policy of the StateManagerExecutionRole does not list the administrator's IAM user or role as a trusted entity to assume the role.
  2. B
    The target EC2 instances are missing the patch group tag that is required to align them with the custom association in Systems Manager Patch Manager.
  3. The administrator's IAM user or role policy is missing the iam:PassRole permission for the StateManagerExecutionRole.Cevap
  4. D
    The administrator's IAM policy grants access to the KMS key used to encrypt Systems Manager outputs, but the KMS key policy itself does not explicitly allow the administrator's IAM user.

Cevap

The administrator's IAM policy is missing the iam:PassRole permission for the StateManagerExecutionRole, preventing the user from passing the role to Systems Manager.
The correct answer is correct because creating a State Manager association that executes tasks using a custom service role requires the user to have the iam:PassRole permission for that role. Without this permission, the AWS API prevents the user from passing the role to Systems Manager, resulting in an Access Denied error during creation.

Adım Adım Çözüm

1
Analyze the error message and context.
The error is 'Access Denied' when creating the State Manager association using a custom service role. This indicates an IAM authorization failure.
Before passing a role to an AWS service, AWS verifies that the caller has permission to pass that specific role.
2
Identify the permission required to pass a role to a service.
The iam:PassRole action is required in the policy attached to the administrator's IAM user or role.
This prevents unauthorized users from passing highly privileged roles to services.
3
Select the option that correctly identifies this missing authorization.
The correct option is the one stating that the administrator's policy is missing the iam:PassRole permission.
Without this permission, any attempt to create a service association or task using that role will fail with an Access Denied error.

Anahtar Kavram

IAM PassRole requirement for AWS Systems Manager Service Roles
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation