Examkin

Question

Difficulty: MediumAWS Service Catalog Portfolio and Product Management

Developers in a member account are attempting to deploy a database environment using a newly assigned AWS Service Catalog product. During the deployment, the provisioning status changes to failure, and the underlying resources are terminated. The product is configured to run under a specific launch constraint role. A SysOps administrator is tasked with finding the root cause of the deployment failure and applying the fix.

Which two actions should the SysOps administrator take to troubleshoot and resolve this provisioning issue? (Select TWO.)

  1. Inspect the provisioning events under Provisioned Products or the corresponding AWS CloudFormation stack events in the member account.Answer
  2. Ensure that the IAM role specified in the launch constraint has the `iam:PassRole` permission for any IAM roles being created or assigned by the template.Answer
  3. C
    Grant the `iam:PassRole` permission directly to the IAM group or role of the developers who are launching the product.
  4. D
    Modify the trust relationship of the target database IAM role to allow the developer's IAM identity to assume it directly.
  5. E
    Check the CloudFormation stack execution logs in the master/hub account where the portfolio is registered.

Answer

The correct actions are to inspect the provisioning events in the member account and ensure the launch constraint role has the `iam:PassRole` permission.
The correct actions are to inspect the provisioning events or CloudFormation stack events in the member account to find the root cause, and to ensure that the launch constraint role has the necessary `iam:PassRole` permissions to assign the required roles to the resources. Since AWS Service Catalog performs the deployment using the launch constraint role, that role needs the permission to pass other roles, rather than the end developers who trigger the launch. Also, since deployments are local to the member account, CloudFormation stack details must be inspected there.

Step-by-Step Solution

1
Navigate to the AWS Service Catalog or AWS CloudFormation console in the local member account.
Identify the specific resource failure and error message that triggered the rollback.
Local deployments execute CloudFormation stacks in the local account, so troubleshooting logs must be inspected there rather than in the sharing hub account.
2
Inspect the launch constraint role permissions.
Confirm whether the launch constraint role lacks the `iam:PassRole` permission.
AWS Service Catalog uses the launch constraint role as the execution identity, meaning this role must have permissions to pass other roles to AWS services, whereas the end user's personal IAM policy does not need this permission.

Key Concept

AWS Service Catalog launches products within the target member account using the permissions defined in the launch constraint role, which requires proper IAM policies including `iam:PassRole` to provision service-linked configurations.
Rate this question

Topics

AWS Service Catalog Portfolio and Product Management