You are planning to use AWS Config to check the configuration of the resources in your AWS account. You are planning to use an existing IAM role and use it for the AWS Config resource. Which of the following is required to ensure the AWS config service can work as required?

Answer options:

A.Ensure that there is a trust policy in place for the AWS Config service within the role.
B.Ensure that there is a grant policy in place for the AWS Config service within the role.
C.Ensure that there is a user policy in place for the AWS Config service within the role.
D.Ensure that there is a group policy in place for the AWS Config service within the role.

Answer: A
Option A is CORRECT because you need to ensure that there is a trust policy in place for the AWS Config service, as shown below.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "config.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Options B is incorrect because working along with AWS Config and IAM, you need to add the IAM trust policy to the role and not the grant policy.
Options C is incorrect because working along with AWS Config and IAM, you need to add the IAM trust policy to the role and not the user policy.
Options D is incorrect because working along with AWS Config and IAM, you need to add the IAM trust policy to the role and not the group policy.
For more information on the IAM role permissions, kindly refer to the following URL:
https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html