CloudFormation stack deployments fail for some users due to permission inconsistencies. Which combination of steps will ensure consistent deployments MOST securely? (Select THREE.)

Question

Options

• ACreate a composite principal service role.
• BCreate a service role with cloudformation.amazonaws.com as the principal.
• CAttach scoped policies to the service role.
• DAttach service ARNs in policy resources.
• EUpdate each stack to use the service role.
• FAllow iam:PassRole to the service role.

• A
  17% (3)
• B
  72% (13)
• C
  6% (1)
• D
  6% (1)

Explanation

CloudFormation Service Role Deployments

Creating a dedicated CloudFormation service role (B) with cloudformation.amazonaws.com as the principal establishes a consistent identity that CloudFormation assumes during deployments, eliminating per-user permission inconsistencies. Each stack must then be explicitly configured to use that service role (E), ensuring all deployments execute under the same permissions regardless of which user initiates the deployment. Finally, granting iam:PassRole (F) to users allows them to hand off the service role to CloudFormation without granting them excessive permissions - this is the secure "handoff" mechanism IAM requires.

Why the distractors are wrong:

• A – A "composite principal" is not a standard AWS construct; CloudFormation specifically requires its own service principal
• C – While scoping policies is good practice, it's not one of the three core steps needed to solve the consistency problem described; the question targets the structural solution
• D – Attaching service ARNs in policy resources is a general policy-writing practice, not a specific step for solving cross-user deployment consistency

Memory Tip: Think "Create → Assign → Permit" - Create the service role (B), Assign it to each stack (E), and Permit users to pass it (F). If users can't pass the role, they can't trigger deployments, no matter what else is configured.

No community discussion yet for this question.