Examkin

Soru

Zorluk: OrtaIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an Amazon ECS task to run on an Amazon EC2 instance. The task must read data from an Amazon S3 bucket. The administrator creates an IAM role named ECSTaskS3AccessRole with an attached policy that allows S3 read access.

The trust policy for ECSTaskS3AccessRole is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the administrator attempts to run the task using the AWS CLI under the SysOpsAdmin IAM user identity, the command fails with the following error:
`ClientError: An error occurred (AccessDenied) when calling the RunTask operation: User: arn:aws:iam::123456789012:user/SysOpsAdmin is not authorized to perform: iam:PassRole on resource: arn:aws:iam::123456789012:role/ECSTaskS3AccessRole`

Which of the following actions are required to resolve this error and ensure the ECS task can successfully run with the required permissions? (Select TWO.)

  1. Add an IAM policy statement to the SysOpsAdmin user that allows the iam:PassRole action targeting the ECSTaskS3AccessRole resource ARN.Cevap
  2. Update the trust policy of the ECSTaskS3AccessRole to list ecs-tasks.amazonaws.com as the trusted service principal instead of ecs.amazonaws.com.Cevap
  3. C
    Add an IAM policy statement to the SysOpsAdmin user that allows the sts:AssumeRole action targeting the ECSTaskS3AccessRole resource ARN.
  4. D
    Update the trust policy of the ECSTaskS3AccessRole to allow the SysOpsAdmin user to perform the iam:PassRole action.

Cevap

To resolve the error, the administrator must add an IAM policy statement to the SysOpsAdmin user allowing the iam:PassRole action on the role, and update the role's trust policy to use the ecs-tasks.amazonaws.com service principal.
To run an Amazon ECS task with an IAM role, the user performing the action must have the iam:PassRole permission to pass the role to the ECS service. Additionally, the trust policy of the role must trust the ECS tasks service principal (ecs-tasks.amazonaws.com) to assume the role. Therefore, adding an IAM policy statement allowing iam:PassRole to the SysOpsAdmin user and updating the trust policy to use ecs-tasks.amazonaws.com are both required.

Adım Adım Çözüm

1
Identify the missing user permission
The error output explicitly states that the SysOpsAdmin user is not authorized to perform iam:PassRole on the role resource.
When launching an ECS task that uses a task role, AWS requires the calling user to have permission to pass that role to the service.
2
Grant the iam:PassRole permission
Add an identity-based policy statement to the SysOpsAdmin user containing Effect: Allow, Action: iam:PassRole, and Resource: arn:aws:iam::123456789012:role/ECSTaskS3AccessRole.
This authorizes the administrator to associate the role with the ECS task.
3
Correct the service trust relationship principal
Modify the 'Service' field in the role's trust policy from 'ecs.amazonaws.com' to 'ecs-tasks.amazonaws.com'.
The 'ecs.amazonaws.com' principal is for the core ECS service (e.g., managing instances/services), whereas ECS containers running tasks require the 'ecs-tasks.amazonaws.com' principal to assume the task role.

Anahtar Kavram

IAM PassRole permissions and service trust relationships for ECS tasks
Bu soruyu puanla

Konular

IAM Policies, Roles, and Service Control Policies (SCPs)

Bu konudan daha fazla soru