Examkin

Question

Difficulty: Very hardAWS Service Catalog Portfolio and Product Management

An organization uses AWS Service Catalog to distribute standardized infrastructure templates. The central hub account shares a portfolio with several spoke accounts. In one of the spoke accounts, the SysOps administrator creates a local launch constraint for a product in the shared portfolio. This launch constraint specifies a local IAM role named CustomProvisioningRole that possesses all necessary permissions to create the required resources. When a developer in the spoke account tries to launch the product, the deployment immediately fails, and the developer receives an error indicating that they do not have permission to perform the action. Which action must the administrator take to resolve this issue?

  1. Attach an IAM policy to the developer's IAM identity in the spoke account that grants the iam:PassRole permission for the CustomProvisioningRole.Answer
  2. B
    Modify the trust policy of the CustomProvisioningRole in the spoke account to allow the developer's IAM identity to perform the sts:AssumeRole action.
  3. C
    Configure the KMS key policy of the encryption key in the hub account to explicitly allow the developer's IAM identity in the spoke account to decrypt deployment artifacts.
  4. D
    Wait for the CloudFormation stack status to transition to ROLLBACK_FAILED, then manually delete the resource stack in the spoke account before attempting to re-provision the product.

Answer

Attach an IAM policy to the developer's IAM identity in the spoke account that grants the iam:PassRole permission for the CustomProvisioningRole.
To use a launch constraint, the user or role launching the product must have the iam:PassRole permission for the role specified in the constraint. This permission allows the user to pass the role to AWS Service Catalog, which then assumes the role to provision resources on behalf of the user.

Step-by-Step Solution

1
Identify the authorization mechanism used for provisioning permissions during the AWS Service Catalog product launch.
The deployment uses a launch constraint pointing to a local IAM role named CustomProvisioningRole in the spoke account.
Understanding which principal initiates the resource creation and how permissions are delegated is key to diagnosing the authorization failure.
2
Analyze the error context where the developer fails to launch the product despite the local role having proper resource creation permissions.
The developer is the initiator who needs to pass the CustomProvisioningRole to the AWS Service Catalog service so the service can assume it.
AWS IAM requires explicit iam:PassRole permission on the user or group initiating a service call that involves passing an IAM role.
3
Formulate the correct policy change required on the developer's IAM identity in the spoke account.
Create and attach an IAM policy to the developer granting the iam:PassRole action on the CustomProvisioningRole resource.
This grants the developer the necessary authority to delegate the CustomProvisioningRole to the Service Catalog service.

Key Concept

AWS Service Catalog Launch Constraints and IAM Role Delegation
Rate this question

Topics

AWS Service Catalog Portfolio and Product Management