Examkin

Question

Difficulty: EasyAWS Service Catalog Portfolio and Product Management

To enforce principal-based execution, a company requires all AWS Service Catalog provisioning to occur under a specific IAM role. While attempting to establish a launch constraint for a product portfolio, the platform administrator is blocked by an access denied error. The administrator already has full access to the target IAM role and AWS Service Catalog. Which specific IAM permission must be added to the administrator's IAM policy to allow them to assign this IAM role to the launch constraint?

  1. A
    sts:AssumeRole
  2. B
    iam:CreateRole
  3. iam:PassRoleAnswer
  4. D
    cloudformation:CreateStack

Answer

iam:PassRole
To apply a launch constraint to an AWS Service Catalog product or portfolio, the user or role performing the action must have the iam:PassRole permission on the target IAM role. This ensures that the administrator has the authority to delegate the execution of tasks to that specific role.

Step-by-Step Solution

1
Identify the action causing the permission error.
The administrator is trying to assign an IAM role as a launch constraint to an AWS Service Catalog portfolio.
Setting a launch constraint requires delegating provisioning capabilities to a specific role, which represents passing that role to the Service Catalog service.
2
Determine the required IAM permission for passing roles to AWS services.
The iam:PassRole action is the standard AWS mechanism for authorizing a principal to delegate a role to an AWS service.
Without the iam:PassRole permission, users are blocked from assigning highly privileged roles to services to prevent privilege escalation.

Key Concept

AWS Service Catalog Launch Constraints and IAM PassRole Requirement
Rate this question

Topics

AWS Service Catalog Portfolio and Product Management