Examkin

Question

Difficulty: HardAWS Service Catalog Portfolio and Product Management

A company's infrastructure team distributes standardized environments across multiple business units using AWS Service Catalog portfolios. An administrator is configuring a launch constraint in a spoke account using an IAM role named CatalogLaunchRole to enforce principal-based execution. When a team member attempts to provision a product, the deployment fails. The provisioning details reveal two distinct errors: one stating that the user is not authorized to pass the launch role, and another in the AWS CloudFormation event log showing a failure to create an IAM instance profile. Which of the following actions must be taken to resolve these deployment errors? (Select TWO.)

  1. Configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource.Answer
  2. Update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action.Answer
  3. C
    Modify the trust relationship of CatalogLaunchRole to grant iam:PassRole permissions to the developer's IAM principal.
  4. D
    Add the iam:CreateInstanceProfile action directly to the developer's IAM identity policy.
  5. E
    Modify the CloudFormation stack policy in the spoke account to explicitly allow the creation of IAM resources.

Answer

Configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource, and update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action.
The correct actions are to configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource, and to update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action. When using an AWS Service Catalog launch constraint, the user launching the product must have the iam:PassRole permission to pass the specified launch role to the Service Catalog service. Additionally, because the launch role is used to execute the underlying CloudFormation deployment, that role must possess the permissions needed to create every resource in the template, including the IAM instance profile.

Step-by-Step Solution

1
Address the user-side authorization failure by examining the developer's IAM policy.
Identify that the developer lacks the permission to pass the CatalogLaunchRole.
Before AWS Service Catalog can assume the launch role under a launch constraint, the requesting principal must have iam:PassRole permission for that specific role.
2
Add the iam:PassRole permission to the developer's policy, targeting the CatalogLaunchRole ARN.
The developer is now authorized to delegate provisioning actions to the launch role.
This resolves the authorization error preventing the deployment from starting.
3
Address the underlying CloudFormation resource creation failure by examining the CatalogLaunchRole permissions.
Identify that the role lacks permissions to create IAM instance profiles.
During launch constraint execution, all resource creation actions are executed by the launch role. The role must have policies allowing it to provision all resources in the CloudFormation template.
4
Add iam:CreateInstanceProfile (and other required IAM actions) to the CatalogLaunchRole's permission policy.
The launch role can successfully create the instance profile during deployment.
This resolves the CloudFormation permission failure and prevents the stack from rolling back.

Key Concept

Under AWS Service Catalog launch constraints, the user needs iam:PassRole permissions for the launch role, and the launch role itself must have all the permissions required to create the resources in the underlying CloudFormation template.
Rate this question

Topics

AWS Service Catalog Portfolio and Product Management