Developers in a member account are attempting to deploy a database environment using a newly assigned AWS Service Catalog product. During the deployment, the provisioning status changes to failure, and the underlying resources are terminated. The product is configured to run under a specific launch constraint role. A SysOps administrator is tasked with finding the root cause of the deployment failure and applying the fix.
Which two actions should the SysOps administrator take to troubleshoot and resolve this provisioning issue? (Select TWO.)
- Inspect the provisioning events under Provisioned Products or the corresponding AWS CloudFormation stack events in the member account.Cevap
- Ensure that the IAM role specified in the launch constraint has the `iam:PassRole` permission for any IAM roles being created or assigned by the template.Cevap
- CGrant the `iam:PassRole` permission directly to the IAM group or role of the developers who are launching the product.
- DModify the trust relationship of the target database IAM role to allow the developer's IAM identity to assume it directly.
- ECheck the CloudFormation stack execution logs in the master/hub account where the portfolio is registered.
Cevap
The correct actions are to inspect the provisioning events in the member account and ensure the launch constraint role has the `iam:PassRole` permission.
The correct actions are to inspect the provisioning events or CloudFormation stack events in the member account to find the root cause, and to ensure that the launch constraint role has the necessary `iam:PassRole` permissions to assign the required roles to the resources. Since AWS Service Catalog performs the deployment using the launch constraint role, that role needs the permission to pass other roles, rather than the end developers who trigger the launch. Also, since deployments are local to the member account, CloudFormation stack details must be inspected there.
Adım Adım Çözüm
Anahtar Kavram
AWS Service Catalog launches products within the target member account using the permissions defined in the launch constraint role, which requires proper IAM policies including `iam:PassRole` to provision service-linked configurations.