Examkin

Soru

Zorluk: OrtaTroubleshooting CloudFormation and CI/CD Deployments

A developer is configuring an AWS CodePipeline where an AWS CodeBuild stage runs automated unit tests. The CodeBuild project has been assigned a custom IAM service role with permission policies that grant access to target Amazon S3 buckets and Amazon CloudWatch Logs. However, when the pipeline runs, the CodeBuild execution fails during the start phase with the error message: `CodeBuild is not authorized to perform: sts:AssumeRole on the specified service role`. What is the correct action to troubleshoot and resolve this failure?

  1. Update the trust policy of the custom IAM service role to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.Cevap
  2. B
    Add the sts:AssumeRole action to the identity-based permission policy attached to the custom IAM service role.
  3. C
    Create a buildspec.yml file in the root of the source code repository and specify the sts:AssumeRole command under the pre_build phase.
  4. D
    Modify the AWS CodePipeline service role permissions to allow the pipeline to assume the container's Amazon ECS task execution role.

Cevap

Update the trust policy of the custom IAM service role to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct action is to update the trust policy of the custom IAM service role to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action. For AWS CodeBuild to execute a build, the CodeBuild service itself must be authorized to assume the role assigned to the project. This authorization is granted through the role's trust policy, not its permission policy.

Adım Adım Çözüm

1
Identify the cause of the failure based on the error message.
The error `CodeBuild is not authorized to perform: sts:AssumeRole` indicates that AWS CodeBuild cannot assume the IAM role assigned to the project.
When CodeBuild starts a build, it must assume the specified service role using the Security Token Service (STS) to gain permissions to access other AWS services.
2
Locate and edit the IAM service role in the AWS Management Console or via CLI.
Access the Trust Relationships tab of the custom IAM role.
The trust policy defines which entities (services, users, or accounts) are allowed to assume the role.
3
Configure the trust policy to allow the CodeBuild service principal.
Add 'codebuild.amazonaws.com' as a trusted service principal with the 'sts:AssumeRole' action.
This establishes the necessary trust relationship, resolving the authorization error and allowing CodeBuild to run the project successfully.

Anahtar Kavram

AWS CodeBuild Service Role Trust Relationships
Bu soruyu puanla

Konular

Troubleshooting CloudFormation and CI/CD Deployments

Bu konudan daha fazla soru