ExamPark
Course menuDOP-C02

Exams / DOP-C02 / Study guide / Reusable governed templates (Service Catalog, modules)

Reusable governed templates (Service Catalog, modules): DOP-C02 study notes and practice questions

What to know about Reusable governed templates (Service Catalog, modules) for the DOP-C02 exam, from the Configuration Management and IaC domain (17% of the exam guide), then 1 free question to test it. Part of the DOP-C02 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

Service Catalog questions describe teams that need self-service infrastructure without broad IAM permissions.

Building blocks

  • Product: a CloudFormation (or Terraform) template with versions.
  • Portfolio: a collection of products, shared with users, groups, roles or accounts.
  • Provisioned product: a launched instance of a product.

Constraints

Constraint Does
Launch constraint Provisions under a named IAM launch role, so end users need only Service Catalog permissions, not the underlying service permissions
Template constraint Limits parameter values, such as allowed instance types
Notification constraint Sends stack events to SNS
StackSet constraint Deploys across accounts and Regions
Tag update constraint Allows or blocks tag changes after launch

TagOptions enforce consistent tags on provisioned products.

Sharing

  • Share portfolios with accounts or whole OUs through Organizations, from a hub account or delegated admin.
  • Recipients can import and add local constraints.
  • Updating a product version lets users update their provisioned products.

Reuse alternatives

Tool Fits
Service Catalog Self-service with governance: approved products, constrained parameters, launch roles
CloudFormation modules Reusable resource groups inside templates written by engineers
CDK constructs Reuse in code
Control Tower Account Factory Vending whole accounts (which uses Service Catalog)

Common traps

  • Giving users full EC2 and RDS permissions to launch approved stacks. Use a launch constraint.
  • Copying templates into every account instead of sharing a portfolio.
  • Trusting users to tag correctly when TagOptions enforce it.
  • A launch role with admin rights. Scope it to what the product template creates.
  • Letting users edit templates to change instance sizes, when a template constraint lists the allowed values.

Try the 1 practice question

Practice Reusable governed templates (Service Catalog, modules)Take the free practice exam

Question 1

Medium ·Link to this question (question 1)

A university's research IT group wants lab administrators to launch standard EC2 workstations for graduate students without giving them broad IAM permissions in the account. The workstations must use an approved AMI, an approved instance type and an approved subnet.

The group has already published the workstation template as a Service Catalog product in a portfolio that is shared with the lab administrators. When a lab administrator launches the product, the provisioning fails with an access denied error on ec2:RunInstances.

The group wants the lab administrators to keep only Service Catalog access, and it wants the provisioning permissions to stay limited to what the template creates.

Which change meets these requirements?

Choose one answer.

  1. A. Attach the AdministratorAccess managed policy to the lab administrators' roles, so that the Service Catalog product can create the instance as the administrator would.
  2. B. Create a launch constraint on the product that names an IAM role limited to the permissions the template needs, so Service Catalog assumes that role to provision.
  3. C. Publish the CloudFormation template to an S3 bucket, and ask each lab administrator to deploy the template directly with their own console permissions.
  4. D. Share the portfolio with each student's personal account, so that students can launch the product in their own accounts without involving the lab administrators.
Show the answer and explanation

Answer: B

  • A. Wrong: Administrator access lets lab administrators do far more than launch workstations, which the group wants to avoid. It replaces a narrow permission with a broad one.
  • B. Right: Correct. A launch constraint makes Service Catalog assume the named role when it provisions the product, so end users need only Service Catalog permissions. The role can be limited to the EC2, subnet and AMI actions the template uses. Learn more: AWS Service Catalog launch constraints (opens in a new tab)
  • C. Wrong: This moves the provisioning out of Service Catalog, so the approved product and its controls are no longer enforced. Each administrator would then need broad CloudFormation and EC2 permissions. Learn more: What is CloudFormation? (opens in a new tab)
  • D. Wrong: Sharing with personal accounts gives students control over their own accounts, which the university does not want. It also does not address the launch permission problem in the research account. Learn more: What is Service Catalog? (opens in a new tab)

Explanation

Service Catalog launch constraints let a product be provisioned under a named IAM role instead of the end user's permissions. End users keep only Service Catalog access, and the role is scoped to what the template creates. Broad administrator access, direct template deployments and sharing with personal accounts each break one of the university's requirements.

Study

Want more on Reusable governed templates (Service Catalog, modules)? The 5 full-length practice sets have 5 more Reusable governed templates (Service Catalog, modules) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Reusable governed templates (Service Catalog, modules)

More Configuration Management and IaC topics