Examkin

Question

Difficulty: MediumIAM Policies and Roles

A developer is setting up an AWS CodeBuild project to automate a build pipeline. The project is configured to use a custom service role named CodeBuildServiceRole to access AWS resources. However, when starting a build run, the build fails immediately during the provisioning phase with the following error:

Failed to assume role: CodeBuild is not authorized to perform: sts:AssumeRole on the role CodeBuildServiceRole

The developer examines the trust policy for CodeBuildServiceRole, which contains the following JSON document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification should the developer make to the trust policy to resolve this error?

  1. A
    Attach an IAM permissions policy to the role that grants the sts:AssumeRole action to codebuild.amazonaws.com.
  2. Change the Service principal in the trust policy statement from ec2.amazonaws.com to codebuild.amazonaws.com.Answer
  3. C
    Configure the buildspec.yml file to define temporary AWS access keys and secret keys under the environment variables section.
  4. D
    Modify the Principal element of the trust policy to use "AWS": "codebuild.amazonaws.com" instead of the Service block.

Answer

Change the Service principal in the trust policy statement from ec2.amazonaws.com to codebuild.amazonaws.com.
The correct action is to update the trust policy's Principal to allow the CodeBuild service (codebuild.amazonaws.com) to assume the role. The error occurs because the trust policy currently only trusts the EC2 service (ec2.amazonaws.com) to assume it.

Step-by-Step Solution

1
Analyze the error message indicating that CodeBuild is not authorized to assume the role.
Identify that the issue lies in the role's trust relationship rather than the permissions policy.
The error message explicitly points to sts:AssumeRole authorization failure for the CodeBuild service principal.
2
Examine the role's trust policy document.
Observe that the Principal block currently specifies "Service": "ec2.amazonaws.com".
The role currently trusts only the EC2 service to assume it, preventing other services like CodeBuild from performing the sts:AssumeRole operation.
3
Modify the Service principal to target the correct service.
Change the Principal to "Service": "codebuild.amazonaws.com".
This establishes a trust relationship that explicitly authorizes the AWS CodeBuild service to assume the role during build execution.

Key Concept

An IAM role requires a trust policy (trust relationship) that designates which principal (e.g., an AWS service like CodeBuild) is allowed to assume the role via the sts:AssumeRole action.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic