DOP-C02 practice question: Reusable governed templates (Service Catalog, modules)
Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A university's research IT group wants lab administrators to launch standard EC2 workstations for graduate students without giving them broad IAM permissions in the account. The workstations must use an approved AMI, an approved instance type and an approved subnet.
The group has already published the workstation template as a Service Catalog product in a portfolio that is shared with the lab administrators. When a lab administrator launches the product, the provisioning fails with an access denied error on ec2:RunInstances.
The group wants the lab administrators to keep only Service Catalog access, and it wants the provisioning permissions to stay limited to what the template creates.
Which change meets these requirements?
Choose one answer.
AA. Attach the AdministratorAccess managed policy to the lab administrators' roles, so that the Service Catalog product can create the instance as the administrator would.
BB. Create a launch constraint on the product that names an IAM role limited to the permissions the template needs, so Service Catalog assumes that role to provision.
CC. Publish the CloudFormation template to an S3 bucket, and ask each lab administrator to deploy the template directly with their own console permissions.
DD. Share the portfolio with each student's personal account, so that students can launch the product in their own accounts without involving the lab administrators.
Show the answer and explanation
Answer: B
A. Wrong: Administrator access lets lab administrators do far more than launch workstations, which the group wants to avoid. It replaces a narrow permission with a broad one.
B. Right: Correct. A launch constraint makes Service Catalog assume the named role when it provisions the product, so end users need only Service Catalog permissions. The role can be limited to the EC2, subnet and AMI actions the template uses. Learn more: AWS Service Catalog launch constraints (opens in a new tab)
C. Wrong: This moves the provisioning out of Service Catalog, so the approved product and its controls are no longer enforced. Each administrator would then need broad CloudFormation and EC2 permissions. Learn more: What is CloudFormation? (opens in a new tab)
D. Wrong: Sharing with personal accounts gives students control over their own accounts, which the university does not want. It also does not address the launch permission problem in the research account. Learn more: What is Service Catalog? (opens in a new tab)
Explanation
Service Catalog launch constraints let a product be provisioned under a named IAM role instead of the end user's permissions. End users keep only Service Catalog access, and the role is scoped to what the template creates. Broad administrator access, direct template deployments and sharing with personal accounts each break one of the university's requirements.
Want more on Reusable governed templates (Service Catalog, modules)? The 5 full-length practice sets have 5 more Reusable governed templates (Service Catalog, modules) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →