Examkin

Question

Difficulty: HardAWS Service Catalog Portfolio and Product Management

An operations team uses AWS Service Catalog to distribute standardized resources. In a consumer AWS account, a SysOps administrator has configured a launch constraint on an imported portfolio using a local IAM role named SC-Launch-Role. A developer in the consumer account attempts to provision a new product version from this portfolio. The product's CloudFormation template is designed to launch an Amazon EC2 instance and create a new IAM role for that instance. During the provisioning process, the deployment fails, and the CloudFormation stack rolls back with an Access Denied error during the creation of the IAM role. Which configuration change is required to successfully provision the product?

  1. Add the iam:CreateRole and iam:PassRole permissions to the IAM policy attached to SC-Launch-Role in the consumer account.Answer
  2. B
    Attach an IAM policy to the developer's IAM user or role that grants the iam:PassRole permission for the SC-Launch-Role.
  3. C
    Modify the trust policy of SC-Launch-Role in the consumer account to allow the developer's IAM role to assume it, and remove the launch constraint from the portfolio.
  4. D
    Log in to the hub account's AWS CloudFormation console and search for the failed stack events to locate and resolve the template parameter errors.

Answer

Add the iam:CreateRole and iam:PassRole permissions to the IAM policy attached to SC-Launch-Role in the consumer account.
The correct answer is to add the iam:CreateRole and iam:PassRole permissions to the launch constraint role (SC-Launch-Role) in the consumer account. When a launch constraint is applied to an AWS Service Catalog portfolio, the service assumes that role to execute the CloudFormation template. Because the template attempts to create a new IAM role and attach it to an EC2 instance, the launch role itself must have the permissions to create that IAM role and pass it to the EC2 service.

Step-by-Step Solution

1
Identify the IAM entity performing the resource creation.
Since a launch constraint is configured, AWS Service Catalog assumes the specified role (SC-Launch-Role) in the consumer account to deploy the CloudFormation stack.
This determines which principal's permissions are evaluated when the stack creation fails with Access Denied.
2
Analyze the failed resource action and its required permissions.
The template attempts to create an IAM role and assign it to an EC2 instance. This requires the performing principal to have iam:CreateRole to create the role, and iam:PassRole to assign (pass) the role to the EC2 service.
Ensures the launch role has sufficient privileges to provision all resources declared in the template.
3
Update the IAM policy of the launch constraint role in the consumer account.
Add iam:CreateRole and iam:PassRole to the policy of SC-Launch-Role.
Resolves the Access Denied error during the CloudFormation execution.

Key Concept

AWS Service Catalog Launch Constraints and Role Permissions
Rate this question

Topics

AWS Service Catalog Portfolio and Product Management