Examkin

Soru

Zorluk: OrtaResolving IAM and Authorization Failures

A developer is setting up a new AWS CodeBuild project to compile an application. The developer creates an IAM role named CodeBuildServiceRole to serve as the service role for the project and attaches policies allowing access to Amazon S3 and Amazon CloudWatch Logs. However, when the developer attempts to start the build run, it fails immediately with the following error:

CodeBuild is not authorized to perform: sts:AssumeRole on arn:aws:iam::123456789012:role/CodeBuildServiceRole

What action should the developer take to resolve this authorization failure?

  1. Update the trust policy of CodeBuildServiceRole to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.Cevap
  2. B
    Add a statement to the IAM permissions policy attached to CodeBuildServiceRole that allows the sts:AssumeRole action.
  3. C
    Define the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables inside the buildspec.yml file to authorize CodeBuild.
  4. D
    Configure an Amazon Cognito Identity Pool to authenticate the CodeBuild agent and provide temporary security credentials.

Cevap

Update the trust policy of the IAM service role to allow the CodeBuild service principal (codebuild.amazonaws.com) to assume the role.
The error indicates that the AWS CodeBuild service itself is not authorized to assume the role specified. For an AWS service to assume an IAM role, the role's trust policy (trust relationship) must explicitly grant 'sts:AssumeRole' permission to the service principal, in this case, 'codebuild.amazonaws.com'. Updating the trust policy resolves this failure.

Adım Adım Çözüm

1
Analyze the error message.
The error shows that the CodeBuild service principal is unable to assume the specified service role (sts:AssumeRole fails).
Before CodeBuild can execute, it needs to assume the role to inherit its permissions.
2
Inspect the trust relationship of the IAM role.
Identify that the trust policy is either missing or does not specify codebuild.amazonaws.com as a trusted entity.
The trust policy is what establishes trust between the IAM role and the AWS service principal.
3
Update the trust policy document.
Add a trust statement allowing the 'sts:AssumeRole' action to the 'codebuild.amazonaws.com' principal.
This grants CodeBuild the authority to assume the role successfully.

Anahtar Kavram

IAM Service Role Trust Policies
Bu soruyu puanla

Konular

Resolving IAM and Authorization Failures

Bu konudan daha fazla soru