Examkin

Question

Difficulty: MediumAWS Service Catalog Portfolio and Product Management

An administrator shares a Service Catalog portfolio from an AWS Organizations management account to a member account. The sharing operation is successful, and the portfolio appears in the member account as an imported portfolio. However, developers in the member account who use the AWS Management Console cannot see the portfolio or its associated products. What must the member account's administrator do to make the portfolio and its products visible to the developers?

  1. Associate the developers' IAM roles or groups with the imported portfolio in the member account.Answer
  2. B
    Configure a launch constraint on the imported portfolio and assign it an IAM role with iam:PassRole permissions.
  3. C
    Accept the shared portfolio within the AWS CloudFormation console and resolve any nested stack rollback issues.
  4. D
    Update the AWS Key Management Service (AWS KMS) key policy of the portfolio to grant decrypt permissions to the developers' IAM roles.

Answer

Associate the developers' IAM roles or groups with the imported portfolio in the member account.
When a portfolio is shared from a management or delegated administrator account to a member account, it appears in the member account as an imported portfolio. Although the portfolio is present, it is not visible to any end-users in that account until the local administrator associates local IAM users, groups, or roles with the portfolio. Once associated, those users can see and launch the products in the portfolio.

Step-by-Step Solution

1
Identify the state of the shared portfolio in the member account.
The portfolio exists in the member account as an 'imported portfolio' but is not visible to end-users.
When a portfolio is shared, it is imported into the target account, but no local IAM users or roles are automatically associated with it.
2
Determine the mechanism for granting end-user access to Service Catalog portfolios.
Access is granted by associating IAM principals (users, groups, or roles) directly with the portfolio.
AWS Service Catalog requires explicit mapping between local IAM identities and portfolios to govern which products users can view and launch.
3
Associate the developers' IAM roles or groups with the portfolio.
The developers can now view the portfolio and its products in their Service Catalog console.
Once the association is complete, the metadata and products of the portfolio become visible to the assigned principals.

Key Concept

AWS Service Catalog Portfolio Sharing and Access Control
Estimated Time:1m 30s
Rate this question

Topics

AWS Service Catalog Portfolio and Product Management