Examkin

Soru

Zorluk: KolayAWS CodeBuild

A developer creates a new AWS CodeBuild project and configures a custom IAM role for the build environment. However, when attempting to run the build, the execution fails immediately before starting any phases with an error indicating that CodeBuild is unable to assume the configured service role. Which of the following is the most likely cause of this failure?

  1. A
    The buildspec.yml file has been placed in a subdirectory of the source code repository instead of the root directory.
  2. B
    The permissions policy attached to the custom IAM role is missing the sts:AssumeRole permission for the CodeBuild service.
  3. The trust policy of the custom IAM role does not grant the codebuild.amazonaws.com service principal permission to assume the role.Cevap
  4. D
    The credentials required for the build environment were stored as Systems Manager Parameter Store String parameters instead of SecureString parameters.

Cevap

The trust policy of the custom IAM role does not grant the codebuild.amazonaws.com service principal permission to assume the role.
For AWS CodeBuild to execute a build project, it must assume the specified IAM service role. This requires the IAM role's trust policy (trust relationship) to explicitly list the CodeBuild service principal (codebuild.amazonaws.com) in the Principal block and allow the sts:AssumeRole action. If the trust policy is missing or misconfigured, CodeBuild will fail to assume the role and the build cannot start.

Adım Adım Çözüm

1
Analyze the error message regarding the inability to assume the service role.
Identify that the issue is related to the relationship between the service (AWS CodeBuild) and the IAM role.
Before any build phases can run, CodeBuild must assume the service role to obtain temporary security credentials.
2
Verify where service trust is established in AWS IAM.
Recognize that service trust is defined in the trust policy (or trust relationship) of the role, rather than its permissions policy.
The trust policy determines which entities (users, accounts, or services) are allowed to assume the role.
3
Identify the correct service principal for AWS CodeBuild.
Ensure that the principal 'codebuild.amazonaws.com' is configured to allow 'sts:AssumeRole'.
If this configuration is missing, IAM blocks CodeBuild from assuming the role, resulting in an immediate failure.

Anahtar Kavram

AWS CodeBuild IAM service role trust relationship
Bu soruyu puanla

Konular

AWS CodeBuild

Bu konudan daha fazla soru