SCS-C02 · Question #477
A company uses AWS Organizations to manage an organization that consists of three workload OUs: Production, Development, and Testing. The company uses AWS CloudFormation templates to define and deploy
The correct answer is A. Review the AWS CloudTrail logs in the account in the Production OU. Search for any failed API. Reviewing AWS CloudTrail logs is the first step to determine which specific API calls failed due to insufficient permissions. CloudTrail logs will show which actions were attempted by AWS CloudFormation and which permissions were denied. This information will help identify if the
Question
A company uses AWS Organizations to manage an organization that consists of three workload OUs: Production, Development, and Testing. The company uses AWS CloudFormation templates to define and deploy workload infrastructure in AWS accounts that are associated with the OUs. Different SCPs are attached to each workload OU. The company successfully deployed a CloudFormation stack update to workloads in the Development OU and the Testing OU. When the company uses the same CloudFormation template to deploy the stack update in an account in the Production OU, the update fails. The error message reports insufficient IAM permissions. What is the FIRST step that a security engineer should take to troubleshoot this issue?
Options
- AReview the AWS CloudTrail logs in the account in the Production OU. Search for any failed API
- BRemove all the SCPs that are attached to the Production OU. Rerun the CloudFormation stack
- CConfirm that the role used by CloudFormation has sufficient permissions to create, update, and
- DMake all the SCPs that are attached to the Production OU the same as the SCPs that are
How the community answered
(53 responses)- A75% (40)
- B4% (2)
- C8% (4)
- D13% (7)
Explanation
Reviewing AWS CloudTrail logs is the first step to determine which specific API calls failed due to insufficient permissions. CloudTrail logs will show which actions were attempted by AWS CloudFormation and which permissions were denied. This information will help identify if the issue is caused by a restrictive Service Control Policy (SCP) or an IAM role permission issue, providing a clear path for troubleshooting.
Topics
Community Discussion
No community discussion yet for this question.