Examkin

Question

Difficulty: Very hardAWS Service Catalog Portfolio and Product Management

An enterprise distributes standardized development environments across a multi-account organization using AWS Organizations. The SysOps administrator in the central hub account (111122223333) has shared a Service Catalog portfolio containing a web application product with a member development account (444455556666). In the hub account, the portfolio is configured with a launch constraint that specifies a launch role named ServiceCatalogLaunchRole.

When an IAM user in the development account attempts to provision the shared product, the provisioning fails, and the underlying CloudFormation stack rolls back.

Which two actions must the SysOps administrator take in the development account to ensure the product can be successfully provisioned? (Select TWO.)

  1. Define an IAM role named ServiceCatalogLaunchRole within the development account, assign the required resource provisioning permissions, and configure its trust relationship to allow servicecatalog.amazonaws.com to assume the role.Answer
  2. Associate an IAM policy with the provisioning user in the development account to grant the PassRole permission for the ServiceCatalogLaunchRole ARN.Answer
  3. C
    Associate an IAM policy with the provisioning user in the development account that permits the user to assume the ServiceCatalogLaunchRole in the hub account using the STS AssumeRole API.
  4. D
    Update the trust relationship of the ServiceCatalogLaunchRole in the hub account to trust the development account's users, and share the role's ARN with the development account.
  5. E
    In the development account, create a custom resource policy on the shared portfolio that explicitly allows CloudFormation to execute API calls on behalf of the provisioning user.

Answer

To resolve the provisioning failure, the administrator must define the ServiceCatalogLaunchRole locally in the development account with a trust policy allowing the servicecatalog.amazonaws.com service principal to assume it, and grant the provisioning user the PassRole permission for that local role ARN.
When a portfolio is shared across accounts in AWS Organizations, launch constraints are evaluated in the context of the recipient account. Therefore, the specified execution role must exist in the recipient account (development account) and have a trust relationship allowing the AWS Service Catalog service principal to assume it. Additionally, the user provisioning the product must have the permission to pass this local role to the service.

Step-by-Step Solution

1
Analyze the cross-account launch constraint behavior.
Identify that the launch role name specified in the hub portfolio constraint must map to a local role in the target development account.
AWS Service Catalog executes CloudFormation deployments locally within the target account using the specified role name.
2
Define the IAM role in the recipient account.
Create ServiceCatalogLaunchRole in account 444455556666 with resource creation permissions.
The role must exist locally in the development account to have the authority to provision resources in that specific account.
3
Establish the service trust relationship on the local role.
Configure the trust policy of the local role to trust servicecatalog.amazonaws.com.
Allows the AWS Service Catalog service principal to assume this execution role during provisioning.
4
Configure provisioning user permissions.
Grant PassRole permission for the local role to the provisioning IAM user.
Ensures the user has the authority to delegate the execution role to the AWS Service Catalog service.

Key Concept

AWS Service Catalog cross-account portfolio sharing requires the specified launch constraint role to exist locally in the recipient account and requires the provisioning principal to have PassRole permission for that role.
Rate this question

Topics

AWS Service Catalog Portfolio and Product Management