Examkin

Question

Difficulty: HardTroubleshooting CloudFormation and CI/CD Deployments

A developer is setting up a new AWS CodeBuild project to build and package a containerized application. The developer creates an IAM role named CodeBuildDeploymentRole and attaches the AWSCodeBuildDeveloperAccess managed policy. When the developer initiates a build run, the build fails immediately during the setup phase with the error message: "CodeBuild is not authorized to perform: sts:AssumeRole on the specified credentials role". Which action should the developer take to resolve this failure?

  1. A
    Add a statement to the trust policy of the CodeBuildDeploymentRole that allows the codepipeline.amazonaws.com service principal to assume the role.
  2. Modify the trust relationship of the CodeBuildDeploymentRole to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  3. C
    Attach an inline permission policy to the CodeBuildDeploymentRole that explicitly allows the sts:AssumeRole action on the role's own ARN.
  4. D
    Execute the aws cloudformation continue-update-rollback command to bypass the IAM error and allow the build to proceed.

Answer

Modify the trust relationship of the CodeBuildDeploymentRole to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct answer is to modify the trust relationship of the role to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action. For any AWS service to assume an IAM role, the role's trust policy must explicitly permit the service's principal to perform the sts:AssumeRole API call.

Step-by-Step Solution

1
Analyze the error message showing that AWS CodeBuild is unauthorized to perform sts:AssumeRole on the specified IAM role.
Identify that the issue is due to a misconfigured IAM Trust Policy on the target role, preventing CodeBuild from assuming it.
Before a build execution begins, the CodeBuild service must assume the project's service role to acquire temporary security credentials.
2
Update the trust policy document of the CodeBuildDeploymentRole via the IAM Console or CLI.
Add codebuild.amazonaws.com as a trusted entity allowed to call sts:AssumeRole.
This establishes the trust relationship required for the AWS CodeBuild service principal to assume this specific role.

Key Concept

IAM Service Roles and Trust Relationships
Estimated Time:2m 0s
Rate this question

Topics

Troubleshooting CloudFormation and CI/CD Deployments

More questions from this topic