A developer is setting up an AWS CodeBuild project that needs to upload build artifacts to an Amazon S3 bucket named `app-build-artifacts-2026`. The project fails with an authorization error during the build phase. The developer reviews the IAM role created for CodeBuild, which currently has no permissions policies attached, and has the following trust policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Which two changes are required to allow the CodeBuild project to upload artifacts to the S3 bucket? (Select TWO.)
- Update the Service principal in the trust policy to codebuild.amazonaws.com.Cevap
- Attach a permissions policy to the role that allows s3:PutObject on the resource arn:aws:s3:::app-build-artifacts-2026/*.Cevap
- CChange the Service principal in the trust policy to s3.amazonaws.com.
- DAdd s3:PutObject to the Action array inside the existing trust policy statement.
- EHardcode the AWS access key and secret access key of an administrator IAM user within the build command script.
Cevap
The correct changes are to update the Service principal in the trust policy to codebuild.amazonaws.com, and to attach a permissions policy to the role that allows s3:PutObject on the resource arn:aws:s3:::app-build-artifacts-2026/*.
Updating the Service principal to codebuild.amazonaws.com allows CodeBuild to assume the execution role. Attaching a policy allowing s3:PutObject on arn:aws:s3:::app-build-artifacts-2026/* grants the required write permissions on the bucket's objects.
Adım Adım Çözüm
Anahtar Kavram
An IAM role must have a trust policy allowing the executing AWS service principal to assume it, and a permissions policy granting the specific API access needed for resources.