[Solved] You created an IAM role with this trust policy:{ "Statement": [{ "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action":... | AWS

AWS - Identity and Access Management

You created an IAM role with this trust policy:

{ "Statement": [{ "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "iam:PassRole" }] }

Why can't EC2 instances assume this role?

ABecause the Effect should be Deny

BBecause the Principal service is incorrect

CBecause the action should be sts:AssumeRole, not iam:PassRole

DBecause EC2 instances cannot assume roles

Step-by-Step Solution

Solution:

Step 1: Identify the required action in trust policy
The trust policy must allow the action sts:AssumeRole for the trusted entity to assume the role.
Step 2: Analyze the given policy
The policy uses iam:PassRole, which is incorrect for trust. This prevents EC2 from assuming the role.
Final Answer:
Because the action should be sts:AssumeRole, not iam:PassRole -> Option C
Quick Check:
Trust policy action must be sts:AssumeRole [OK]

Quick Trick: Trust policy action must be sts:AssumeRole [OK]

Common Mistakes:

Master "Identity and Access Management" in AWS

9 interactive learning modes - each teaches the same concept differently

More AWS Quizzes

You created an IAM role with this trust policy: