Examkin

Question

Difficulty: MediumAWS CodeBuild

An organization is setting up a continuous integration pipeline. The build phase is executed by AWS CodeBuild using a custom IAM service role. However, during the initial run, the build fails immediately before executing any build phases, throwing an error that CodeBuild is not authorized to assume the specified service role. Which of the following actions will resolve this issue?

  1. Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.Answer
  2. B
    Attach a permission policy to the IAM service role that grants the sts:AssumeRole permission to the developer's IAM user.
  3. C
    Move the buildspec.yml file from the root directory to a newly created configuration subdirectory in the source repository.
  4. D
    Modify the build project settings to retrieve credentials using AWS Secrets Manager rather than Systems Manager Parameter Store.

Answer

Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.
The correct answer is to modify the trust policy of the IAM service role. AWS CodeBuild requires a service role to perform actions on your behalf. For CodeBuild to assume this role, the role's trust policy must explicitly allow the 'codebuild.amazonaws.com' service principal to perform the 'sts:AssumeRole' action. Without this trust relationship, CodeBuild cannot run the build project and fails immediately during initialization.

Step-by-Step Solution

1
Identify the service principal for AWS CodeBuild.
The service principal is codebuild.amazonaws.com.
AWS services require trust relationships defined by their specific service principal to assume IAM roles.
2
Locate the trust policy of the CodeBuild service role in the IAM console.
The trust policy is found under the 'Trust relationships' tab of the role.
The trust policy determines which entities are trusted to assume the role.
3
Update the trust policy document to include the service principal with sts:AssumeRole permission.
CodeBuild is now authorized to assume the role, and the build starts successfully.
Allowing the service principal in the trust policy resolves the authorization failure during CodeBuild initialization.

Key Concept

AWS CodeBuild service role trust policy configuration
Rate this question

Topics

AWS CodeBuild

More questions from this topic