Examkin

Question

Difficulty: HardResolving IAM and Authorization Failures

A developer is troubleshooting a cross-account deployment failure. A CI/CD pipeline using AWS CodePipeline in Account A (111111111111111111111111) needs to deploy resources into Account B (222222222222222222222222) by assuming a role named `CrossAccountDeployRole` in Account B.

The pipeline fails at the deploy stage with the error:
`CodePipeline is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::222222222222:role/CrossAccountDeployRole`

In Account B, the developer has configured the following trust policy for `CrossAccountDeployRole`:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codepipeline.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which two actions should the developer take to resolve this authorization failure?

  1. Attach an IAM policy to the CodePipeline service role in Account A that allows the `sts:AssumeRole` action on `arn:aws:iam::222222222222:role/CrossAccountDeployRole`.Answer
  2. Update the trust policy of `CrossAccountDeployRole` in Account B to replace the `codepipeline.amazonaws.com` service principal with the ARN of the CodePipeline service role in Account A.Answer
  3. C
    Attach an identity-based permission policy to `CrossAccountDeployRole` in Account B that allows the `sts:AssumeRole` action on the CodePipeline service role in Account A.
  4. D
    Store a set of long-term IAM user access keys from Account B inside the CodePipeline configuration and pass them as environment variables.
  5. E
    Configure an Amazon Cognito Identity Pool in Account B to authenticate the CodePipeline service principal and issue temporary credentials.

Answer

Attach an IAM policy to the CodePipeline service role in Account A that allows the `sts:AssumeRole` action, and update the trust policy of `CrossAccountDeployRole` in Account B to trust the CodePipeline service role in Account A.
For cross-account role assumption, two permissions must be aligned: the initiator (CodePipeline service role in Account A) must have an identity policy allowing the `sts:AssumeRole` action on the target role, and the receiver (the target role in Account B) must have a trust policy listing the initiator's role ARN as a trusted principal. Using the service principal `codepipeline.amazonaws.com` is incorrect because cross-account actions are performed by the role executing the pipeline, not the service itself.

Step-by-Step Solution

1
Identify the principal attempting the assume-role action.
The AWS CodePipeline execution in Account A operates under the security context of the CodePipeline service role, not the generic service principal.
Understanding the security principal is essential for establishing cross-account access.
2
Configure the trust relationship on the target role in Account B.
Modify the trust policy of `CrossAccountDeployRole` in Account B to trust the specific IAM role ARN from Account A rather than the service principal.
A trust policy must trust the calling identity's ARN to allow cross-account access.
3
Configure permissions on the initiating role in Account A.
Attach an identity policy to the CodePipeline service role in Account A permitting `sts:AssumeRole` on the target role ARN in Account B.
IAM requires both the target trust policy and the caller's permission policy to allow cross-account operations.

Key Concept

Cross-account IAM role assumption requires both an identity-based permission policy in the source account allowing sts:AssumeRole, and a trust policy in the target account permitting the source principal to assume it.
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic