SOA-C02 · Question #650
A non-production application is installed on an Amazon EC2 instance. The application's developer has created an Amazon CloudWatch alarm that reboots the EC2 instance if a critical application error…
The correct answer is B. Ensure that the developer has the iam:CreateServiceLinkedRole permission. When a CloudWatch alarm is configured to perform an EC2 action such as rebooting an instance, CloudWatch needs a service-linked role that grants it the necessary permissions. If the service- linked role does not exist, CloudWatch attempts to create it, which requires the…
Question
A non-production application is installed on an Amazon EC2 instance. The application's developer has created an Amazon CloudWatch alarm that reboots the EC2 instance if a critical application error occurs. When the developer tests the new alarm, the alarm enters ALARM state. However, the EC2 instance fails to reboot. A SysOps administrator needs to troubleshoot the developer's IAM permissions. What should the SysOps administrator do to ensure that the developer can configure the alarm correctly?
Options
- AEnsure that the developer has the iam:AttachGroupPolicy permission.
- BEnsure that the developer has the iam:CreateServiceLinkedRole permission.
- CEnsure that the developer has the iam:CreateServiceSpecificCredential permission.
- DEnsure that the developer does not have the iam:EnableMFADevice permission.
How the community answered
(41 responses)- A2% (1)
- B78% (32)
- C5% (2)
- D15% (6)
Explanation
When a CloudWatch alarm is configured to perform an EC2 action such as rebooting an instance, CloudWatch needs a service-linked role that grants it the necessary permissions. If the service- linked role does not exist, CloudWatch attempts to create it, which requires the iam:CreateServiceLinkedRole permission. By ensuring the developer has the iam:CreateServiceLinkedRole permission, the necessary role can be created, and the alarm will be able to perform the EC2 reboot action.
Topics
Community Discussion
No community discussion yet for this question.