A developer is configuring an AWS CodeBuild project to deploy an infrastructure stack using AWS CloudFormation. The deployment process requires CloudFormation to assume a specific IAM service role named `CFNDeploymentRole` to create resources. The CodeBuild build container runs under an IAM role named `CodeBuildExecutionRole`.
Which two configuration steps must the developer perform to ensure the deployment succeeds? (Select two.)
- Attach an IAM policy to `CodeBuildExecutionRole` that grants the `iam:PassRole` action on the `CFNDeploymentRole` resource ARN.Answer
- Configure the trust policy of `CFNDeploymentRole` to allow the `cloudformation.amazonaws.com` service principal to assume the role.Answer
- CConfigure the trust policy of `CFNDeploymentRole` to allow the `codebuild.amazonaws.com` service principal to assume the role.
- DAttach an IAM policy to `CFNDeploymentRole` that grants `iam:AssumeRole` permission for the `CodeBuildExecutionRole` ARN.
- EStore the AWS access key ID and secret access key of an administrative IAM user as environment variables in the CodeBuild project configuration.
Answer
To ensure successful deployment, the developer must attach an IAM policy to `CodeBuildExecutionRole` granting `iam:PassRole` on `CFNDeploymentRole`, and configure `CFNDeploymentRole`'s trust policy to allow `cloudformation.amazonaws.com` to assume it.
To successfully deploy the stack, two main configurations are required. First, the CodeBuild execution role must have the authority to pass the deployment role to AWS CloudFormation, which is accomplished via the `iam:PassRole` permission. Second, the deployment role must allow CloudFormation to assume it, which is configured by adding `cloudformation.amazonaws.com` to the trust policy of the deployment role.
Step-by-Step Solution
Key Concept
IAM Role delegation and the use of the `iam:PassRole` permission to pass service roles to AWS services.