Examkin

Question

Difficulty: MediumAWS CodePipeline

A developer is configuring a release pipeline in AWS CodePipeline. The pipeline contains a stage that must invoke an AWS Lambda function to perform deployment validation tests. The developer creates a new IAM role for the pipeline to interact with AWS resources. During the first execution of the pipeline, the run fails at the Lambda stage with an access denied error. The developer verifies that the IAM policy attached to the pipeline's service role explicitly grants the `lambda:InvokeFunction` permission. Which of the following configuration failures is preventing the pipeline from executing the Lambda function?

  1. The IAM trust policy of the pipeline's service role does not allow the CodePipeline service principal (codepipeline.amazonaws.com) to assume the role.Answer
  2. B
    The trust policy of the Lambda function's execution role does not list the CodePipeline service role as a trusted entity.
  3. C
    The pipeline is configured to retrieve the Lambda function's invocation token from AWS Systems Manager Parameter Store, which does not support the automatic credential rotation required by CodePipeline.
  4. D
    The Lambda function is defined under the Resources section of a CodeDeploy AppSpec file instead of being invoked directly as a stage action in CodePipeline.

Answer

The IAM trust policy of the pipeline's service role does not allow the CodePipeline service principal (codepipeline.amazonaws.com) to assume the role.
The correct answer is correct because AWS CodePipeline must assume the pipeline's service role to execute stage actions, such as invoking an AWS Lambda function. If the service role's trust policy does not explicitly permit the CodePipeline service principal (`codepipeline.amazonaws.com`) to perform the `sts:AssumeRole` action, CodePipeline cannot assume the role. As a result, the action will fail with an access denied error, regardless of whether the permission policy attached to the role has the `lambda:InvokeFunction` permission.

Step-by-Step Solution

1
Analyze the error message and current configurations.
The pipeline fails with an access denied error during the Lambda invocation stage, despite the pipeline's IAM role having permissions for `lambda:InvokeFunction`.
This indicates that CodePipeline cannot successfully utilize the role, pointing to an issue with role assumption rather than missing execution permissions.
2
Verify how AWS CodePipeline interacts with IAM roles.
AWS CodePipeline requires a trust relationship (trust policy) to assume the service role associated with the pipeline execution.
An IAM role cannot be assumed by an AWS service unless that service is defined as a trusted entity in the role's trust policy.
3
Identify the missing configuration.
The trust policy of the role must include the `codepipeline.amazonaws.com` service principal to allow the service to perform the `sts:AssumeRole` operation.
Correcting this trust policy resolves the access denied issue and allows CodePipeline to invoke the Lambda function.

Key Concept

AWS CodePipeline requires a properly configured IAM trust policy on its service role to allow the service principal to assume the role and execute stage actions.
Estimated Time:1m 30s
Rate this question

Topics

AWS CodePipeline

More questions from this topic