A SysOps Administrator is configuring a launch constraint for an AWS Service Catalog product. The administrator wants to use a custom IAM role named ServiceCatalogLaunchRole to provision the resources. However, when the administrator tries to assign the role as a launch constraint in the AWS Service Catalog console, the console displays an error stating that the chosen role must have a trust relationship with Service Catalog. Furthermore, the administrator needs to ensure they have the necessary permissions to apply this constraint. Which two actions should the administrator take to resolve the console error and successfully apply the launch constraint? (Select two.)
- Edit the trust policy of ServiceCatalogLaunchRole to allow the servicecatalog.amazonaws.com service principal to assume the role.Answer
- Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for ServiceCatalogLaunchRole.Answer
- CAttach an IAM policy to the end-users' IAM groups that grants the iam:PassRole permission for ServiceCatalogLaunchRole.
- DModify the IAM policy of the end-users to allow them to assume ServiceCatalogLaunchRole directly via the sts:AssumeRole action.
- EDisable CloudFormation rollback in the product template to allow the stack to bypass permission checks and complete with warnings.
Answer
Edit the trust policy of the role to allow the servicecatalog.amazonaws.com service principal to assume the role, and attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for that role.
The correct options are to edit the trust policy of the custom role to trust the Service Catalog service principal, and to grant the administrator the iam:PassRole permission. This allows the administrator to associate the role as a launch constraint and enables Service Catalog to assume the role when provisioning the product.
Step-by-Step Solution
Key Concept
AWS Service Catalog Launch Constraints and Role Provisioning Requirements