DEA-C01 Data Operations and Support Practice Question

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::123456789012:role/EMR_DefaultRole"
    },
    {
      "Effect": "Allow",
      "Action": "elasticmapreduce:*",
      "Resource": "*"
    }
  ]
}

A data engineer has this IAM policy attached to their user. They are trying to create an Amazon EMR cluster with a custom service role 'EMR_CustomRole'. What will happen?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The cluster creation will fail with an 'Access Denied' error for iam:PassRole.

The IAM policy allows iam:PassRole only for the specific role 'EMR_DefaultRole'. When creating an EMR cluster with a custom service role 'EMR_CustomRole', the user needs to pass that role, but the policy does not grant iam:PassRole for 'EMR_CustomRole'. Therefore, the cluster creation fails with an 'Access Denied' error for iam:PassRole. Other options are incorrect: A incorrectly attributes failure to elasticmapreduce:* being too broad; B incorrectly assumes success because elasticmapreduce:* is allowed, ignoring the PassRole requirement; D incorrectly states PassRole is not required.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The cluster creation will fail because elasticmapreduce:* is too broad.
Why it's wrong here
Broad permissions are allowed; the issue is with PassRole.
✗
The cluster creation will succeed because elasticmapreduce:* is allowed.
Why it's wrong here
PassRole permission is required for EMR to assume the service role; the policy does not allow passing the custom role.
✓
The cluster creation will fail with an 'Access Denied' error for iam:PassRole.
Why this is correct
The policy restricts PassRole to only the default role, so passing a custom role is denied.
✗
The cluster creation will succeed because PassRole is not required for EMR.
Why it's wrong here
PassRole is required for EMR to assume the service role.

Go deeper

DEA-C01 Data Operations and Support Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question