Examkin

Question

Difficulty: MediumAWS Service Catalog Portfolio and Product Management

A SysOps administrator is configuring a launch constraint for an AWS Service Catalog product using a custom IAM role named `CatalogProvisioningRole`. The role has the necessary policies attached to provision resources. When the administrator attempts to apply the launch constraint to the product in the AWS Service Catalog portfolio, the console returns an access denied error. Additionally, in a previous attempt where the constraint was active, the product provisioning failed and the CloudFormation stack rolled back because the service could not assume the role.

Which two actions should the administrator take to resolve these issues? (Choose two.)

  1. Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `CatalogProvisioningRole` resource.Answer
  2. Configure the trust policy of the `CatalogProvisioningRole` to allow the `servicecatalog.amazonaws.com` service principal to assume the role.Answer
  3. C
    Modify the administrator's IAM policy to grant the `sts:AssumeRole` permission on the `CatalogProvisioningRole` resource.
  4. D
    Update the CloudFormation template's metadata to disable rollback on failure so that the deployment can complete despite the permission issues.
  5. E
    Attach an IAM policy to the administrator's IAM identity that grants `servicecatalog:AssociateConstraint` permissions on all portfolio resources.

Answer

To resolve the issues, the administrator must attach an IAM policy to their identity that grants the `iam:PassRole` permission for the launch constraint role, and configure the trust policy of that role to allow the `servicecatalog.amazonaws.com` service principal to assume it.
The correct options address both issues. First, the administrator must have `iam:PassRole` permissions to associate the role with the launch constraint. Second, the role's trust policy must allow `servicecatalog.amazonaws.com` to assume the role to resolve the assumption failure during product deployment.

Step-by-Step Solution

1
Analyze the console access denied error during launch constraint configuration.
Identify that the administrator lacks permissions to pass the specified role (`CatalogProvisioningRole`) to the Service Catalog service.
When associating a launch constraint role, AWS requires the configuring user to have the `iam:PassRole` permission to prevent privilege escalation.
2
Address the role configuration error by updating the administrator's IAM policy.
Attach a policy allowing `iam:PassRole` on the resource `arn:aws:iam::account-id:role/CatalogProvisioningRole`.
This grants the administrator the ability to bind the role to the launch constraint.
3
Analyze the stack rollback and product provisioning failure.
Identify that the Service Catalog service was unable to assume the role because of a trust relationship misconfiguration.
A launch constraint role must explicitly trust the Service Catalog service principal (`servicecatalog.amazonaws.com`) to assume the role via `sts:AssumeRole`.
4
Configure the trust policy of the IAM role.
Update the trust relationship of `CatalogProvisioningRole` to include the `servicecatalog.amazonaws.com` service principal.
This allows the Service Catalog service to successfully assume the role and execute the CloudFormation template.

Key Concept

AWS Service Catalog Launch Constraints require both the administrator to have `iam:PassRole` permissions and the IAM role's trust policy to trust the Service Catalog service principal.
Rate this question

Topics

AWS Service Catalog Portfolio and Product Management