Examkin

Question

Difficulty: MediumAWS CodeBuild

A developer is configuring a new AWS CodeBuild project to build and package a serverless application. When attempting to start a build, the execution fails immediately with the error message: "Failed to assume the service role." The developer confirms that the associated IAM service role has the correct managed policies for accessing Amazon S3, Amazon CloudWatch Logs, and VPC resources. What should the developer modify to resolve this issue and allow the build to initiate?

  1. The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.Answer
  2. B
    The identity-based permissions policy of the IAM service role, adding a statement that grants the sts:AssumeRole action to the codebuild.amazonaws.com principal.
  3. C
    The location of the buildspec.yml file, moving it to a configuration subdirectory and updating the buildspec path in the CodeBuild project configuration.
  4. D
    The build project's environment variables, dynamically fetching the temporary session credentials of the IAM service role from AWS Systems Manager Parameter Store during the install phase.

Answer

The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.
The correct option is the one specifying the trust relationship of the IAM service role. For AWS CodeBuild to execute a build, it must assume the specified IAM service role. This trust relationship must be defined in the role's trust policy, permitting the 'codebuild.amazonaws.com' service principal to call 'sts:AssumeRole'.

Step-by-Step Solution

1
Analyze the error message "Failed to assume the service role."
Identify that the issue is an authorization failure preventing CodeBuild from assuming the assigned IAM role at build start.
This isolates the issue to the trust boundary between the AWS CodeBuild service and the IAM service role.
2
Differentiate between IAM permissions policies and IAM trust policies.
Determine that while permissions policies govern what the role can do after it is assumed, the trust policy (trust relationship) governs which entities are permitted to assume the role.
This explains why verifying the attached managed policies did not solve the startup failure.
3
Configure the trust relationship to trust CodeBuild.
Add codebuild.amazonaws.com as a trusted service principal with the sts:AssumeRole action.
This allows CodeBuild to successfully assume the role and execute the container environment.

Key Concept

AWS CodeBuild Service Role Trust Policy
Rate this question

Topics

AWS CodeBuild

More questions from this topic