SCS-C03 · Question #134
A company uses several AWS CloudFormation stacks to handle the deployment of a suite of applications. The leader of the company's application development team notices that the stack deployments fail…
The correct answer is B. Create a service role that has cloudformation.amazonaws.com as the service principal. E. Update each stack to use the service role. F. Add a policy to each member role to allow the iam:PassRole action for the service role. AWS CloudFormation supports the use of a service role, which allows CloudFormation to assume a dedicated IAM role to create and manage resources on behalf of users. According to the AWS Certified Security - Specialty Study Guide, using a service role is the most secure and…
Question
A company uses several AWS CloudFormation stacks to handle the deployment of a suite of applications. The leader of the company's application development team notices that the stack deployments fail with permission errors when some team members try to deploy the stacks. However, other team members can deploy the stacks successfully. The team members access the account by assuming a role that has a specific set of permissions. All team members have permissions to perform operations on the stacks. Which combination of steps will ensure consistent deployment of the stacks MOST securely? (Select THREE.)
Options
- ACreate a service role that has a composite principal that contains each service that needs the
- BCreate a service role that has cloudformation.amazonaws.com as the service principal.
- CAdd policies that reference each CloudFormation stack ARN.
- DAdd policies that reference the ARNs of each AWS service that requires permissions.
- EUpdate each stack to use the service role.
- FAdd a policy to each member role to allow the iam:PassRole action for the service role.
How the community answered
(25 responses)- A4% (1)
- B72% (18)
- C16% (4)
- D8% (2)
Explanation
AWS CloudFormation supports the use of a service role, which allows CloudFormation to assume a dedicated IAM role to create and manage resources on behalf of users. According to the AWS Certified Security - Specialty Study Guide, using a service role is the most secure and consistent way to ensure predictable stack deployments when users have varying permission sets. By creating a service role with cloudformation.amazonaws.com as the trusted service principal (Option B), CloudFormation--not individual users--assumes responsibility for resource creation. Updating each stack to explicitly use this service role (Option E) ensures that all deployments use the same permission set, eliminating inconsistencies. Granting the team members permission to pass the service role via iam:PassRole (Option F) is required so that CloudFormation can assume the role during stack operations. This approach adheres to the principle of least privilege and prevents users from gaining direct access to elevated permissions.
Topics
Community Discussion
No community discussion yet for this question.