Examkin

Question

Difficulty: MediumTroubleshooting CloudFormation and CI/CD Deployments

A developer is configuring a multi-account CI/CD pipeline using AWS CodePipeline. The pipeline executes an AWS CodeBuild project in Account A. As part of the build spec, the project runs a deployment script that is designed to deploy an AWS CloudFormation stack in Account B. During execution, the build fails at the deployment step with the error: `An error occurred (AccessDenied) when calling the AssumeRole operation`. Which two actions should the developer take to resolve this failure? (Select TWO.)

  1. In Account A, attach a policy to the CodeBuild service role that grants the `sts:AssumeRole` permission on the target role's Amazon Resource Name (ARN) in Account B.Answer
  2. In Account B, update the trust policy of the target IAM role to allow the ARN of the CodeBuild service role from Account A to assume it.Answer
  3. C
    In Account B, update the permissions policy of the target IAM role to grant the `sts:AssumeRole` permission to the AWS CodeBuild service principal.
  4. D
    In Account A, update the trust policy of the CodeBuild service role to trust the target IAM role in Account B.
  5. E
    In Account B, run the `aws cloudformation delete-stack` command to delete the target stack before initiating the pipeline again.

Answer

In Account A, attach a policy to the CodeBuild service role that grants the `sts:AssumeRole` permission on the target role's ARN in Account B; and in Account B, update the trust policy of the target IAM role to allow the ARN of the CodeBuild service role from Account A to assume it.
The correct options state that a policy must be attached to the CodeBuild service role in Account A granting `sts:AssumeRole` on the target role's ARN, and the target role's trust policy in Account B must be updated to trust the CodeBuild service role from Account A. This pair of configurations satisfies the cross-account delegation requirements in AWS IAM.

Step-by-Step Solution

1
Configure permissions in the source account (Account A)
The CodeBuild service role is granted permission to perform `sts:AssumeRole` on the target role's ARN.
The initiating identity must have explicit permission to invoke the assume role action on the specific target resource.
2
Configure the trust relationship in the target account (Account B)
The target IAM role's trust policy is updated to list the CodeBuild service role's ARN as a trusted entity.
An IAM role cannot be assumed by a principal in another account unless that principal is explicitly trusted in the role's trust policy.

Key Concept

Cross-account IAM role assumption requires granting `sts:AssumeRole` permission in the source account and trusting the source principal in the target role's trust policy.
Estimated Time:2m 0s
Rate this question

Topics

Troubleshooting CloudFormation and CI/CD Deployments

More questions from this topic