Examkin

Soru

Zorluk: OrtaAWS Elastic Disaster Recovery

A SysOps Administrator is using AWS Elastic Disaster Recovery (AWS DRS) to replicate an on-premises database server to AWS. The administrator has configured the default EC2 Launch Template in AWS DRS to attach a specific IAM instance profile to the recovery instance upon launch. However, when the administrator attempts to launch a recovery drill, the launch fail status is returned immediately. A review of AWS CloudTrail logs reveals an authorization error related to the IAM role assignment during the EC2 RunInstances API call. Which action will resolve this issue?

  1. A
    Update the trust policy of the recovery instance's IAM role to allow the drs.amazonaws.com service principal to assume the role.
  2. B
    Configure an Amazon Route 53 active-active failover routing policy to map the target instance profile's DNS name to the recovery instance.
  3. Add the iam:PassRole permission for the recovery instance's IAM role to the IAM policy of the SysOps Administrator.Cevap
  4. D
    Attach a policy to the recovery instance's IAM role that grants sts:AssumeRole to the AWS Elastic Disaster Recovery service role.

Cevap

Add the iam:PassRole permission for the recovery instance's IAM role to the IAM policy of the SysOps Administrator.
When using AWS Elastic Disaster Recovery (AWS DRS), launching a drill or recovery instance initiates a workflow that runs under the context of the IAM user or role starting the action. If the EC2 Launch Template is configured to attach an IAM instance profile to the launched instance, the initiating IAM identity must have the iam:PassRole permission for the target IAM role. Without this permission, the EC2 RunInstances API call fails with an authorization error.

Adım Adım Çözüm

1
Analyze the CloudTrail log error for the failed DRS recovery drill launch.
Identify that the RunInstances API call failed because the user launching the instance is not authorized to perform the PassRole action on the target IAM role.
To attach an IAM role to an EC2 instance, the initiating user must have permission to pass that role to the EC2 service.
2
Modify the IAM policy of the SysOps Administrator initiating the DRS launch.
The SysOps Administrator's IAM policy is updated to include the iam:PassRole permission targeting the specific ARN of the recovery instance's IAM role.
This authorizes the administrator's IAM identity to pass the role to the EC2 service during the DRS recovery drill.
3
Re-run the AWS DRS recovery drill.
The DRS recovery drill launches successfully, and the recovery EC2 instance starts with the configured IAM instance profile attached.
The permission issue has been resolved, allowing the EC2 service to assume the role on behalf of the instance.

Anahtar Kavram

AWS DRS launches recovery instances using the credentials of the user/role initiating the launch, requiring that user/role to have the iam:PassRole permission to attach an IAM role to the launched EC2 instance.
Bu soruyu puanla

Konular

AWS Elastic Disaster Recovery

Bu konudan daha fazla soru