Discuss Amazon SAP-C02 Exam Topic 8 Question 37

A solutions architect is creating an AWS CloudFormation template from an existing manually created non-production AWS environment The CloudFormation template can be destroyed and recreated as needed The environment contains an Amazon EC2 instance The EC2 instance has an instance profile that the EC2 instance uses to assume a role in a parent account

The solutions architect recreates the role in a CloudFormation template and uses the same role name When the CloudFormation template is launched in the child account, the EC2 instance can no longer assume the role in the parent account because of insufficient permissions

What should the solutions architect do to resolve this issue?

AIn the parent account edit the trust policy for the role that the EC2 instance needs to assume Ensure that the target role ARN in the existing statement that allows the sts AssumeRole action is correct Save the trust policy

BIn the parent account edit the trust policy for the role that the EC2 instance needs to assume Add a statement that allows the sts AssumeRole action for the root principal of the child account Save the trust policy

CUpdate the CloudFormation stack again Specify only the CAPABILITY_NAMED_IAM capability

DUpdate the CloudFormation stack again Specify the CAPABIUTYJAM capability and the CAPABILITY_NAMEDJAM capability

Suggested Answer: A

Edit the Trust Policy:

Go to the IAM console in the parent account and locate the role that the EC2 instance needs to assume.

Edit the trust policy of the role to ensure that it correctly allows the sts

action for the role ARN in the child account.

Update the Role ARN:

Verify that the target role ARN specified in the trust policy matches the role ARN created by the CloudFormation stack in the child account.

If necessary, update the ARN to reflect the correct role in the child account.

Save and Test:

Save the updated trust policy and ensure there are no syntax errors.

Test the setup by attempting to assume the role from the EC2 instance in the child account. Verify that the instance can successfully assume the role and perform the required actions.

This ensures that the EC2 instance in the child account can assume the role in the parent account, resolving the permission issue.

Reference

AWS IAM Documentation on Trust Policies51.

Get Premium SAP-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

39 comments · newest first

Willow 11 months ago

CAPABILITY_NAMED_IAM is the way to go for sure.

Rhea 11 months ago

Definitely need to check those permissions!

Allene 11 months ago

Wait, can you really assume roles across accounts like that?

Willis 11 months ago

I think option B makes the most sense!

Theresia 12 months ago

Sounds like a trust policy issue.

Nu 12 months ago

I’m leaning towards option A, but I’m worried that just editing the trust policy might not be enough. We might need to check the role ARN too.

Wava 1 year ago

I feel like I should know the difference between CAPABILITY_NAMED_IAM and CAPABILITY_IAM, but I can't recall the specifics right now.

Edgar 1 year ago

I think option B sounds familiar. We practiced a similar question where we had to allow a role from a different account to assume permissions.

Linsey 1 year ago

I remember we discussed trust policies in class, but I'm not entirely sure if editing the trust policy is the right approach here.

Ryann 1 year ago

This seems straightforward enough. I think option B is the way to go - edit the trust policy in the parent account to allow the child account to assume the role. Shouldn't be too much work to get that sorted out.

Leonardo 1 year ago

I've got a good strategy for this. I'll focus on editing the trust policy in the parent account first, making sure the role ARN is correct and adding the necessary permissions for the child account. That should resolve the issue without needing to mess with the CloudFormation stack.

Madalyn 1 year ago

Okay, I'm a bit confused here. Do I need to update the CloudFormation stack and specify some capabilities? Not sure which ones would be the right choice.

Nan 1 year ago

Hmm, this is a tricky one. I think I'll need to carefully review the trust policy in the parent account to make sure the target role ARN is correct. Might also need to add a statement to allow the child account to assume the role.

Emilio 1 year ago

Hmm, I'm a bit unsure about this one. I'm trying to think through the different options, but I'm not totally sure which one would provide the clearest feedback for employee career growth.

Delpha 2 years ago

I'm going with B. Gotta cover all your bases when dealing with cross-account IAM shenanigans.

Nickolas 2 years ago

↳ replying to Delpha

Definitely, covering all bases with cross-account IAM permissions is crucial for smooth operations.

Felix 2 years ago

↳ replying to Delpha

Agreed, it's important to make sure the EC2 instance has the necessary permissions to assume the role in the parent account.

Karrie 2 years ago

↳ replying to Delpha

I think B is the way to go, adding a statement for the sts AssumeRole action in the trust policy sounds like the right move.

Louann 2 years ago

Ah, the joys of cloud infrastructure management. At least it's not my problem!

Katie 2 years ago

↳ replying to Louann

D) Update the CloudFormation stack again Specify the CAPABIUTYJAM capability and the CAPABILITY_NAMEDJAM capability

Delbert 2 years ago

↳ replying to Louann

C) Update the CloudFormation stack again Specify only the CAPABILITY_NAMED_IAM capability

Eleonora 2 years ago

↳ replying to Louann

B) In the parent account edit the trust policy for the role that the EC2 instance needs to assume Add a statement that allows the sts AssumeRole action for the root principal of the child account Save the trust policy

Brittani 2 years ago

↳ replying to Louann

A) In the parent account edit the trust policy for the role that the EC2 instance needs to assume Ensure that the target role ARN in the existing statement that allows the sts AssumeRole action is correct Save the trust policy

Pete 2 years ago

I think specifying both CAPABILITY_IAM and CAPABILITY_NAMED_IAM capabilities in the CloudFormation stack update is the best approach

Kirk 2 years ago

I believe updating the CloudFormation stack again with only the CAPABILITY_NAMED_IAM capability is the right solution

Raylene 2 years ago

I bet the solutions architect is wishing they had a magic wand right about now.

Rashad 2 years ago

↳ replying to Raylene

Paulene 2 years ago

↳ replying to Raylene

Latrice 2 years ago

Hmm, I'm not sure about this one. Gotta read the question carefully.

Veronica 2 years ago

I agree with Coral, adding a statement for the sts AssumeRole action for the root principal of the child account should resolve the issue

Coral 2 years ago

I think the solutions architect should edit the trust policy for the role in the parent account

Lucy 2 years ago

This is a tricky one. I think the answer is B, as the child account needs explicit permission to assume the role in the parent account.

Cherri 2 years ago

↳ replying to Lucy

That makes sense. It's important to ensure the correct permissions are set up for roles to work properly across accounts.

France 2 years ago

↳ replying to Lucy

Yes, you're right. Adding a statement in the trust policy for the root principal of the child account should resolve the issue.

Mabel 2 years ago

↳ replying to Lucy

I think the answer is B, as the child account needs explicit permission to assume the role in the parent account.

Charlene 2 years ago

↳ replying to Lucy

Yes, that could work too. As long as the EC2 instance has the necessary permissions to assume the role in the parent account.

Jesusita 2 years ago

↳ replying to Lucy

But wouldn't editing the trust policy in the parent account for the role also work?

Lea 2 years ago

↳ replying to Lucy

That makes sense, adding a statement in the trust policy for the root principal of the child account should grant the necessary permissions.

Clay 2 years ago

↳ replying to Lucy

I think the answer is B, as the child account needs explicit permission to assume the role in the parent account.

Amazon SAP-C02 Exam - Topic 8 Question 37 Discussion