SCS-C02 Question 317
Select 4An application running on an EC2 instance is unable to access an S3 bucket, despite an IAM role being attached to the instance. You need to troubleshoot the authorization issue. Which of the following steps should you take to identify the cause of the problem?
- A
Use the IAM Access Advisor to check if the attached IAM role has recently been used to access the S3 bucket.
- B
Use the IAM Policy Simulator to validate whether the attached IAM role has the necessary permissions for the S3 bucket.
- C
Inspect the CloudTrail logs to check for any denied actions related to the S3 bucket for the IAM role.
- D
Verify the IAM role trust policy to ensure the EC2 service is allowed to assume the role.
- E
Inspect the S3 bucket policy to ensure it doesn't explicitly deny access to the IAM role.
Show answer and explanation
Correct answers: B, C, D, E
Explanation
When troubleshooting authorization issues, it is important to examine all potential points of failure. The IAM Policy Simulator can validate permissions, while CloudTrail logs help identify denied actions. Verifying the trust policy ensures the role is assumed correctly, and checking the S3 bucket policy ensures there are no explicit denials. IAM Access Advisor is not suitable for this scenario as it does not provide the necessary granularity to diagnose the problem.
- A. Incorrect.
IAM Access Advisor is useful for checking when a role was last used for specific services, but it does not provide detailed insights into permission issues for accessing resources like S3.
- B. Correct.
The IAM Policy Simulator is a powerful tool to validate whether the attached IAM role has the necessary permissions for specific actions on an S3 bucket.
- C. Correct.
CloudTrail logs can help identify denied actions, which can provide insight into authorization failures for the IAM role.
- D. Correct.
The trust policy of the IAM role must allow the EC2 service to assume the role; otherwise, the role cannot function as expected.
- E. Correct.
The S3 bucket policy might explicitly deny access to the IAM role, overriding other permissions, so it's crucial to inspect it during troubleshooting.