Examkin

Soru

Zorluk: OrtaAWS Service Catalog Portfolio and Product Management

A SysOps Administrator is configuring an AWS Service Catalog product that deploys an Amazon RDS DB instance. The deployment must encrypt the database storage volume using a customer managed AWS KMS key. The product is associated with a portfolio that has a launch constraint configured to use a specific IAM service role. During testing, when an end user attempts to provision the product, the deployment fails with a 'CloudFormation stack rollback occurred' error. How should the administrator resolve this failure?

  1. A
    Attach an IAM policy to the end user's IAM role granting full access to the customer managed KMS key, because the end user's permissions determine key access during product provisioning.
  2. Add the ARN of the Service Catalog launch constraint role to the key policy of the customer managed KMS key, permitting the role to use the key for cryptographic operations.Cevap
  3. C
    Modify the trust policy of the KMS key to trust the end user's IAM role, and add sts:AssumeRole permissions for the launch constraint role to the end user's IAM policy.
  4. D
    Inspect the CloudFormation events for ROLLBACK_IN_PROGRESS and wait for the stack to automatically retry the resource creation, as Service Catalog triggers a rebuild of failed nested stacks upon rollback completion.

Cevap

Add the ARN of the Service Catalog launch constraint role to the key policy of the customer managed KMS key, permitting the role to use the key for cryptographic operations.
When an AWS Service Catalog portfolio is configured with a launch constraint, AWS Service Catalog uses the associated service role's permissions to deploy the product's resources instead of the end user's credentials. Because the RDS database volume is encrypted using a customer managed KMS key, the service role must be granted usage permissions on that key. For customer managed KMS keys, permissions must be explicitly defined in the KMS key policy.

Adım Adım Çözüm

1
Identify the IAM identity responsible for provisioning the resources.
Since a launch constraint is configured on the AWS Service Catalog portfolio, the service role associated with the launch constraint (not the end user) is the identity that performs the actions.
Launch constraints dictate that Service Catalog assumes the specified service role to provision the resources.
2
Determine the permissions requirement for the encrypted RDS storage volume.
The resource must be encrypted with a customer managed KMS key, which requires the provisioning role to have kms:DescribeKey, kms:CreateGrant, kms:Decrypt, and kms:GenerateDataKey permissions.
RDS requires these cryptographic permissions on the KMS key to associate it with the database volume.
3
Configure the key policy of the customer managed KMS key to permit the launch constraint role.
Add the launch constraint role's ARN to the KMS key policy statement allowing key usage.
For customer managed KMS keys, key access must be explicitly permitted by the key policy itself; IAM policies alone are insufficient if the key policy does not delegate authorization to IAM.

Anahtar Kavram

AWS Service Catalog Launch Constraints and KMS Key Policy Delegation
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

AWS Service Catalog Portfolio and Product Management