A central operations team manages AWS Service Catalog portfolios in a hub account (1111222… — AWS Certified SysOps Administrator - Associate

A central operations team manages AWS Service Catalog portfolios in a hub account ( $111122223333$ ) and shares them with spoke accounts in an AWS Organization. A SysOps administrator in a spoke account ( $444455556666$ ) has associated developer IAM groups with an imported portfolio containing a product that deploys a multi-tier application. When developers in the spoke account attempt to launch the product, the deployment fails during the Amazon EC2 instance provisioning stage with an 'Access Denied' error. The developers do not have direct IAM permissions to manage EC2 instances, and the administrator wants to use a local IAM role named `CustomLaunchRole` in the spoke account to perform the deployment. Which two actions must the administrator take in the spoke account to successfully configure and troubleshoot this deployment?

Apply a launch constraint to the imported portfolio in the spoke account ( $444455556666$ ) that maps the product to the CustomLaunchRole role.Answer
Configure the trust policy of CustomLaunchRole to allow the servicecatalog.amazonaws.com service principal to assume the role, and ensure the developers' IAM identity has iam:PassRole permissions for CustomLaunchRole.Answer
C
Attach an IAM policy to the developers' IAM identity that grants sts:AssumeRole permissions on the CustomLaunchRole, and configure the role's trust policy to trust the spoke account's root principal.
D
Navigate to the AWS CloudFormation console in the hub account ( $111122223333$ ) to view the stack events and resource status of the failed provisioned product deployment.
E
Configure the CustomLaunchRole permissions policy in the spoke account to grant the kms:Decrypt action on the default AWS-managed KMS key (aws/ebs) of the hub account.

Answer

To successfully deploy the Service Catalog product, the administrator must configure a launch constraint on the imported portfolio in the spoke account associating it with the CustomLaunchRole, and ensure the CustomLaunchRole trust policy trusts servicecatalog.amazonaws.com while granting the developers iam:PassRole permissions on the CustomLaunchRole.

To deploy a product where the end users (developers) do not have the required permissions to launch the underlying resources (like EC2), a launch constraint must be configured using a service role (such as CustomLaunchRole). This role needs a trust policy allowing AWS Service Catalog (servicecatalog.amazonaws.com) to assume it. Additionally, the developers' IAM identity must have the iam:PassRole permission to pass the CustomLaunchRole to AWS Service Catalog.

Step-by-Step Solution

Configure the local execution role trust policy

The CustomLaunchRole trust policy is modified to allow the servicecatalog.amazonaws.com service principal to assume the role.

This allows AWS Service Catalog to execute the deployment actions on behalf of the user.

Grant the developers permission to pass the role

An IAM policy with the iam:PassRole action targeting the CustomLaunchRole ARN is attached to the developers' IAM group/role.

This authorizes the developers to pass the deployment role to AWS Service Catalog during the launch process.

Create a launch constraint in the spoke account

A launch constraint is added to the imported portfolio in the spoke account (

444455556666

) that maps the product to the CustomLaunchRole.

This ensures that when developers launch the product, Service Catalog uses the permissions of the CustomLaunchRole instead of the developers' permissions.

Key Concept

AWS Service Catalog launch constraints allow products to be deployed using a specified IAM service role rather than the end user's IAM permissions, which requires proper trust policies and iam:PassRole configuration in the target account.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics