Examkin

Question

Difficulty: HardAWS CloudFormation Stack and Drift Management

A SysOps Administrator is using the AWS CLI to troubleshoot a CloudFormation stack that is stuck in the UPDATE_ROLLBACK_FAILED state. The rollback failed because the original custom IAM service role associated with the stack was deleted. The administrator has created a new IAM role with the correct permissions to manage the stack's resources. However, when the administrator executes `aws cloudformation continue-update-rollback --stack-name my-stack --role-arn arn:aws:iam::123456789012:role/NewCFNServiceRole`, the command fails with an AccessDenied error stating that the administrator's IAM user is not authorized to perform the action on the resource. Which of the following describes the root cause of this error, and how should it be resolved?

  1. A
    The trust policy of the new IAM role does not allow the administrator's IAM user to assume the role. To resolve this, add the administrator's IAM user ARN to the sts:AssumeRole action in the trust relationship of the new role.
  2. B
    The rollback failed due to a target capacity mismatch in the underlying resources. To resolve this, the administrator must change the deployment strategy to an in-place rollback by adding the --use-in-place flag to the command.
  3. The administrator's IAM user policy is missing the iam:PassRole permission for the new role's ARN. To resolve this, add a policy to the administrator's IAM user that grants iam:PassRole for the new role.Answer
  4. D
    CloudFormation does not support changing the service role of a stack during a rollback operation. To resolve this, the administrator must recreate the deleted IAM role using the exact same name and ARN as the original service role.

Answer

The administrator's IAM user policy is missing the iam:PassRole permission for the new role's ARN. To resolve this, add a policy to the administrator's IAM user that grants iam:PassRole for the new role.
The correct answer is that the administrator's IAM user policy is missing the iam:PassRole permission for the new role's ARN. When executing stack operations that specify a service role, AWS requires the calling user to have permission to pass that role to the service. Adding the iam:PassRole permission to the administrator's policy resolves the authorization error.

Step-by-Step Solution

1
Identify that the CLI command specifies a new IAM role ARN using the --role-arn parameter.
CloudFormation requires the user executing the command to have permission to pass this role.
CloudFormation will assume this role to perform rollback operations on behalf of the user.
2
Check the user's IAM permissions for the iam:PassRole action on the target role ARN.
An AccessDenied error occurs because the user's IAM policy does not explicitly allow passing the new role.
AWS security guidelines require explicit authorization to pass role permissions to services to prevent privilege escalation.
3
Modify the administrator's IAM policy to include iam:PassRole for the new role's ARN and re-run the CLI command.
The continue-update-rollback command succeeds and the rollback begins.
The user is now authorized to delegate permissions to the CloudFormation service.

Key Concept

IAM PassRole permissions during CloudFormation stack rollback recovery
Estimated Time:2m 0s
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic