Exam AWS Certified Security - Specialty topic 1 question 449 discussion

ANS is BE For those supporting "A", the instance profile is an IAM role for the EC2 instance. A says the IAM role attached to the engineer and this is wrong. B is instance profile which is the same as IAM role for the EC2 instance.

The rights are clearly listed here, supporting BE https://docs.aws.amazon.com/imagebuilder/latest/userguide/image-builder-setting-up.html#image-builder-IAM-prereq

Selected Answer: AD To meet the requirements of resolving the "Access Denied" error with Amazon EC2 Image Builder while adhering to best practices for least privilege access, the following steps should be taken: A. Ensure that the following policies are attached to the IAM role that the security engineer is using: EC2InstanceProfileForImageBuilder, EC2InstanceProfileForImageBuilderECRContainerBuilds, and AmazonSSMManagedInstanceCore. D. Ensure that the security engineer’s IAM role has the s3:PutObject permission for the S3 bucket.

https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html#ts-access-denied

https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html

In the context of the scenario, the best combination would be A and D. Here's why: The IAM role that the security engineer is using to interact with Amazon EC2 Image Builder needs to have the right policies attached. The policies mentioned in Option A (EC2InstanceProfileForImageBuilder, EC2InstanceProfileForImageBuilderECRContainerBuilds, and AmazonSSMManagedInstanceCore) provide the necessary permissions to create and manage EC2 instances for Image Builder, build and test the image, and use Systems Manager capabilities. Option D ensures that the security engineer's IAM role has the permissions needed to write logs to the S3 bucket. It's crucial for the role used to run the pipeline to have this permission, as the pipeline's logs are being sent to an S3 bucket.

i checked BE

Vote for BE. The permission of the user who runs the pipeline is irrelevant.

BE Correct Answer

https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html - Access denied – status code 403

B,E are correct https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html#ts-access-denied

Link supporting A and E: https://docs.aws.amazon.com/imagebuilder/latest/userguide/image-builder-setting-up.html

AE is the answer - E = The instance profile role is missing permissions that are required for logging to Amazon S3. Most commonly, this occurs when the instance profile role does not have PutObject permissions for your S3 buckets. A = An instance profile is a container for an IAM role that you can use to pass role information to an Amazon EC2 instance when the instance starts. You can tag instance profiles when you use the AWS CLI or AWS API. You can use IAM tag key-value pairs to add custom attributes to an instance profile. The IAM role that you associate with your instance profile must have permissions to run the build and test components included in your image. The following IAM role policies must be attached to the IAM role that is associated with the instance profile: EC2InstanceProfileForImageBuilder EC2InstanceProfileForImageBuilderECRContainerBuilds AmazonSSMManagedInstanceCore https://docs.aws.amazon.com/imagebuilder/latest/userguide/security_iam_service-with-iam.html

BE https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html#troubleshooting-pipelines The instance profile is the one which should have the perm

Instance profile is missing managed policies – Add the missing policies to your instance profile role. Then run the pipeline again. Instance profile is missing write permissions for S3 bucket – Add a policy to your instance profile role that grants PutObject permissions to write to your S3 bucket. Then run the pipeline again. https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html#troubleshooting-pipelines

https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html#troubleshooting-pipelines Instance profile should have permissions

Answer should be A,E