SCS-C02 Exam - Question 18

Question

A company uses several AWS CloudFormation stacks to handle the deployment of a suite of applications. The leader of the company's application development team notices that the stack deployments fail with permission errors when some team members try to deploy the stacks. However, other team members can deploy the stacks successfully.

The team members access the account by assuming a role that has a specific set of permissions that are necessary for the job responsibilities of the team members. All team members have permissions to perform operations on the stacks.

Which combination of steps will ensure consistent deployment of the stacks MOST securely? (Choose three.)

Examice · Accepted Answer

To ensure consistent deployment of the stacks most securely, create a service role that has cloudformation.amazonaws.com as the service principal and configure the role to allow the sts:AssumeRole action to ensure that the correct permissions are granted for CloudFormation operations. Update each stack to use this service role so that it uses the permissions defined by the role. Finally, add a policy to each member role to allow the iam:PassRole action and set the policy's resource field to the ARN of the service role to let team members pass the role to CloudFormation during deployments. This combination ensures that only the necessary permissions are granted and used consistently by all team members.

PareshBPatel · Answer

BEF are the correct selection
Thought to consistent deployment of CloudFormation stacks would actually be
B. Create a service role that has cloudformation.amazonaws.com as the service principal. Configure the role to allow the sts:AssumeRole action.
E. Update each stack to use the service role.
F. Add a policy to each member role to allow the iam:PassRole action. Set the policy's resource field to the ARN of the service role.
These steps ensure that CloudFormation has the necessary permissions through a service role designed specifically for it (B), that each stack is configured to use this service role for deployments (E), and that users have the permission to pass this role to CloudFormation (F), aligning with best practices for security and consistency.

Christina666 · Answer

BDF 
By creating a service role specifically for AWS CloudFormation, you can limit the permissions to just what CloudFormation needs, and this reduces the risk of excessive permissions or accidental permission conflicts.

Karamen · Answer

BEF
- Create a CloudFormation service role
- Update your stack using the role when deploying
- ensure iam:passrole

Ciara123456 · Answer

BDF, https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html

WeepingMaplte · Answer

Ans: B D F. 
In Cloud formation, you select the required role during a new creation.  The team members will deploy using the new role. updating the current stacks is not a priority as compared to IAM:PassRole.

mynickc · Answer

I took the exam today (Jan/28) and the choices E & F are two separate as per this question. In some of the comments, it was mentioned that E&F are considered as one choice.

Snape · Answer

BEF is correct

CloudHell · Answer

B ensures that CloudFormation has the necessary permissions through a dedicated service role.
C restricts the permissions to the specific stacks, following the principle of least privilege.
E ensures that each stack uses the service role during deployment.

Raphaello · Answer

B D E

To be able to update each stack to use the service role (E), user needs to be able to pass the role using iam:PassRole (F).
But it is done once.

I would go with E along side B & D.

Lunga778 · Answer

B D And  F

Daniel76 · Answer

B,D and F.
https://blog.awsfundamentals.com/aws-cloudformation-execution-permissions

vincentsr7 · Answer

why not A , dont we need a composite principal

brpjp · Answer

Yes, Correct answer is B D F, based on numbers of linked already provided and passrole from ChatGpt.

Raphaello · Answer

BDE
Create a service role to be used by CloudFormation.
For each service to be used by the CF stack, create the associated set of permissions.
Assign the service role to the stack.

The question does not feel right though, since it mentions all user assume an IAM role to access the account, therefore the stack they launch should use the permissions given to that IAM role, therefore the result should be the same for all users either (they don't launch the stack using their individual IAM users).

shailvardhan · Answer

BEF are the correct answers.

cumzle_com · Answer

B. Create a service role that has cloudformation.amazonaws.com as the service principal. Configure the role to allow the sts
action.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html
D. For each required set of permissions, add a separate policy to the role to allow those permissions. Add the ARN of each service that needs the permissions in the resource field of the corresponding policy.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html#using-iam-servicerole-add
E. Update each stack to use the service role.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html

5409b91 · Answer

B, D, E.

SCS-C02 Exam - Question 18

Discussion