SCS-C02 Question 296
Select 3An application running in your AWS account is failing to authenticate to an S3 bucket. The application assumes an IAM role using AWS STS (Security Token Service). You want to troubleshoot this issue. Which combination of steps will help you identify the root cause of the failure?
- A
Use AWS CloudTrail to verify if the AssumeRole API call for the application was successful.
- B
Check the IAM Access Advisor for the IAM role to see if S3 permissions are granted.
- C
Use the IAM policy simulator to test the permissions of the IAM role against the S3 bucket.
- D
Inspect the S3 bucket policy to ensure it allows access to the assumed IAM role.
- E
Verify the application is running in the same AWS Region as the S3 bucket.
Show answer and explanation
Correct answers: A, C, D
Explanation
To troubleshoot authentication issues, you need to confirm whether the IAM role was successfully assumed (using CloudTrail), ensure permissions are correctly configured (using the IAM policy simulator), and validate that the S3 bucket policy allows access to the assumed role. IAM Access Advisor and Region alignment are not directly relevant to troubleshooting this specific issue.
- A. Correct.
Using AWS CloudTrail to verify the AssumeRole API call can help confirm whether the application successfully assumed the IAM role. If this step fails, the application will not be able to access the S3 bucket.
- B. Incorrect.
IAM Access Advisor is used to determine service access patterns for an IAM role but does not provide detailed information about the role's permissions for specific resources.
- C. Correct.
The IAM policy simulator can help you test and validate the permissions of the IAM role against specific actions and resources, such as the S3 bucket.
- D. Correct.
Inspecting the S3 bucket policy is crucial to verify that it permits access for the assumed IAM role. If the bucket policy denies access, the application will fail to authenticate.
- E. Incorrect.
The application and the S3 bucket do not need to be in the same AWS Region for authentication, as AWS services operate across regions.