Examkin

Soru

Zorluk: ZorVPC Flow Logs and Network Monitoring

A SysOps Administrator is setting up VPC Flow Logs to capture traffic for a critical application and stream it to an Amazon CloudWatch Logs log group. The administrator creates an IAM role named FlowLogDeliveryRole with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role. The role has an attached IAM policy granting logs:CreateLogStream and logs:PutLogEvents permissions. When the administrator attempts to create the flow log using the AWS CLI command 'aws ec2 create-flow-logs', the command returns an AccessDenied error. Which of the following is the most likely cause of this issue?

  1. The administrator's IAM identity does not have the iam:PassRole permission for the FlowLogDeliveryRole resource.Cevap
  2. B
    The trust policy of the FlowLogDeliveryRole must grant the logs.amazonaws.com service principal permission to assume the role.
  3. C
    The CloudWatch Logs log group does not have a resource-based policy that explicitly grants write permissions to the flow logs service.
  4. D
    The AWS CLI command must be initiated via an AWS Systems Manager Automation runbook triggered by an Amazon EventBridge rule to successfully pass the credentials.

Cevap

The administrator's IAM identity does not have the iam:PassRole permission for the FlowLogDeliveryRole resource.
The correct answer is the option stating that the administrator's IAM identity does not have the iam:PassRole permission. When configuring an AWS service like VPC Flow Logs to run actions on your behalf, you must pass an IAM role to the service. To do this, your IAM user or role must have the iam:PassRole permission for that specific target role. Without this permission, the create-flow-logs API call fails with an AccessDenied error.

Adım Adım Çözüm

1
Analyze the IAM configuration of the administrator's identity and the service delivery role.
The service delivery role is configured correctly with the vpc-flow-logs.amazonaws.com service principal and the necessary logs actions, but the CLI command execution fails with AccessDenied.
When passing an IAM role to an AWS service, the user executing the call must be authorized to perform the iam:PassRole action on that role.
2
Differentiate between service-linked roles, trust policies, and pass-role permissions.
The trust policy enables the service to assume the role, but the iam:PassRole permission enables the administrator to associate that role with the flow log resource.
This prevents unauthorized users from assigning high-privilege roles to AWS services.

Anahtar Kavram

IAM PassRole requirement for AWS service configuration
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

VPC Flow Logs and Network Monitoring

Bu konudan daha fazla soru