Examkin

Question

Difficulty: HardAWS Service Catalog Portfolio and Product Management

A SysOps administrator manages a multi-account AWS environment and uses AWS Service Catalog in a hub account to share a portfolio with several spoke accounts within an AWS Organization. To enforce security compliance, the administrator wants all resources provisioned from this portfolio in the spoke accounts to be created using a dedicated IAM role named SCLaunchExecutionRole in each spoke account. The administrator creates the SCLaunchExecutionRole in the spoke accounts, attaches policies containing the required resource provisioning permissions, and configures the trust policy to allow the cloudformation.amazonaws.com service principal to assume the role. The administrator then configures a launch constraint on the shared portfolio in the spoke accounts, specifying SCLaunchExecutionRole as the launch role. However, when developers in the spoke accounts attempt to provision the product, the deployment fails with a status of tainted, and the event logs state that the execution role cannot be assumed. How should the administrator resolve this deployment failure?

  1. A
    Attach an IAM policy to the developer IAM groups in the spoke accounts that grants the iam:PassRole permission for the SCLaunchExecutionRole.
  2. Update the trust policy of the SCLaunchExecutionRole in the spoke accounts to trust the servicecatalog.amazonaws.com service principal.Answer
  3. C
    Manually create the CloudFormation stacks in the spoke accounts using the SCLaunchExecutionRole, and then use the AWS Service Catalog associate action to link the stacks.
  4. D
    Add the sts:AssumeRole permission to the developers' IAM policies in the spoke accounts, allowing them to assume the SCLaunchExecutionRole directly during provisioning.

Answer

Update the trust policy of the SCLaunchExecutionRole in the spoke accounts to trust the servicecatalog.amazonaws.com service principal.
The correct answer is to update the trust policy of the execution role to trust the AWS Service Catalog service principal. When a launch constraint is applied to a product in a portfolio, the AWS Service Catalog service must assume the specified IAM role to perform provisioning actions. Because the original role was only configured to trust AWS CloudFormation, AWS Service Catalog was blocked from assuming the role, resulting in the deployment failure.

Step-by-Step Solution

1
Analyze the error message indicating that the launch constraint role cannot be assumed.
Identified that the service attempting to assume the role lacks the required trust relationship authorization.
Before AWS Service Catalog can deploy resources, it must be allowed to assume the specified launch constraint role.
2
Examine the trust policy of the SCLaunchExecutionRole.
Observed that the trust policy currently only allows cloudformation.amazonaws.com to assume the role.
Although CloudFormation does the physical deployment, AWS Service Catalog is the service that initiates the assumption of the launch constraint role.
3
Modify the trust policy of the SCLaunchExecutionRole in the spoke accounts.
Added servicecatalog.amazonaws.com to the Trust Relationship statement's Principal block.
This grants the AWS Service Catalog service the authorization to assume the role and perform provisioning tasks on behalf of the end user.

Key Concept

AWS Service Catalog Launch Constraints and Multi-Account IAM Roles
Rate this question

Topics

AWS Service Catalog Portfolio and Product Management