Examkin

Question

Difficulty: MediumIAM Policies, Roles, and Service Control Policies (SCPs)

An operations team is implementing a continuous integration and continuous delivery (CI/CD) pipeline to deploy infrastructure using AWS CloudFormation. The pipeline runner executes under an IAM role named `PipelineDeploymentRole`. To enforce the principle of least privilege, the team creates a separate IAM role named `CloudFormationServiceRole` that contains only the permissions required to create and manage the specific resources in the stack. When the pipeline runner attempts to initiate the deployment and specifies the service role, the deployment fails with an error indicating that the runner is not authorized to use the specified service role.

Which configuration changes must be made to allow the pipeline runner to successfully deploy the stack using this service role? (Select TWO.)

  1. Add an IAM policy to the `PipelineDeploymentRole` that allows the `iam:PassRole` action targeting the Amazon Resource Name (ARN) of the `CloudFormationServiceRole`.Answer
  2. Configure the trust policy of the `CloudFormationServiceRole` to allow the `cloudformation.amazonaws.com` service principal to perform the `sts:AssumeRole` action.Answer
  3. C
    Add an IAM policy to the `PipelineDeploymentRole` that allows the `sts:AssumeRole` action targeting the `CloudFormationServiceRole`.
  4. D
    Configure the trust policy of the `PipelineDeploymentRole` to permit the `cloudformation.amazonaws.com` service principal to perform the `iam:PassRole` action.
  5. E
    Add an IAM policy to the `CloudFormationServiceRole` that allows the `iam:PassRole` action targeting the `PipelineDeploymentRole`.

Answer

To resolve the issue, the pipeline runner role must be granted `iam:PassRole` permissions to pass the CloudFormation service role, and the CloudFormation service role's trust policy must allow the CloudFormation service principal to assume it.
To successfully deploy an AWS CloudFormation stack using a service role, two components are required: first, the calling principal (the pipeline runner using `PipelineDeploymentRole`) must have `iam:PassRole` permissions to delegate the `CloudFormationServiceRole` to AWS CloudFormation; second, the `CloudFormationServiceRole` must have a trust policy allowing the AWS CloudFormation service principal (`cloudformation.amazonaws.com`) to assume the role via `sts:AssumeRole`.

Step-by-Step Solution

1
Analyze the service delegation model for AWS CloudFormation.
Understand that the deployment pipeline runner passes the execution role to AWS CloudFormation, which then assumes the role to perform resource provisioning.
This flow dictates the required permissions: the pipeline runner needs to pass the role, and CloudFormation needs to assume the role.
2
Configure the permission policy of the calling identity (`PipelineDeploymentRole`).
Add `iam:PassRole` targeting the ARN of `CloudFormationServiceRole` to the policy attached to the pipeline runner.
Without `iam:PassRole`, AWS prevents users or roles from passing a role to an AWS service to prevent privilege escalation.
3
Configure the trust policy (assume role policy document) of the execution role (`CloudFormationServiceRole`).
Set the Principal to `cloudformation.amazonaws.com` and Action to `sts:AssumeRole`.
This allows the CloudFormation service to assume the permissions of the role when executing stack operations.

Key Concept

IAM Role Delegation and PassRole vs AssumeRole Permissions
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic