Publish the environment as a Service Catalog product with a launch constraint

SAP-C02 By islever Editorial Last updated

Prescribe security controls. Design a multi-account AWS environment. Determine a strategy to improve overall operational excellence.

Short answer

B Publish the template as a Service Catalog product with a launch constraint using the existing role and grant testers only Service Catalog API access.

Question

A company has an application that uses Amazon EC2 instances in an Auto Scaling group. The quality assurance (QA) department needs to launch a large number of short-lived environments to test the application. The application environments are currently launched by the manager of the department using an AWS CloudFormation template. To launch the stack, the manager uses a role with permission to use CloudFormation, EC2, and Auto Scaling APIs. The manager wants to allow testers to launch their own environments, but does not want to grant broad permissions to each user. Which set up would achieve these goals?
  1. Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to assume the manager’s role and add a policy that restricts the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
  2. Create an AWS Service Catalog product from the environment template. Add a launch constraint to the product with the existing role. Give users in the QA department permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console. Correct Answer
  3. Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to use CloudFormation and S3 APIs, with conditions that restrict the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
  4. Create an AWS Elastic Beanstalk application from the environment template. Give users in the QA department permission to use Elastic Beanstalk permissions only. Train users to launch Elastic Beanstalk environments with the Elastic Beanstalk CLI, passing the existing role to the environment as a service role.

Key Takeaways

A Service Catalog launch constraint pins the role used to create the provisioned product, so testers only need permission to call Service Catalog APIs and never receive any of the underlying CloudFormation, EC2, or Auto Scaling permissions themselves.

A QA department needs to launch many short-lived test environments from an existing CloudFormation template, currently done by one manager using a role that can call CloudFormation, EC2, and Auto Scaling. The manager wants testers to self-serve without granting broad permissions to each of them.

Common mistake: Letting users assume the manager's role. Assuming that role grants every permission the role has, and adding a policy on the user's own session to narrow it does not reduce what the assumed role can do, so the effective permissions remain far broader than intended.

Expert Analysis

Why the Answer Is Correct

AWS Service Catalog is built for exactly this self-service scenario. The environment template is published as a product, and a launch constraint is configured on that product specifying the existing role, so every launch performed by any tester uses that role regardless of who requested it. Testers are then granted permission to use only AWS Service Catalog APIs, which lets them search the catalog and launch the product but gives them no CloudFormation, EC2, or Auto Scaling permissions at all. Because the provisioning role is attached to the product rather than to a user, the permissions model is centrally controlled and testers cannot escalate from the launch capability, and the manager can control what is offered by editing the product.

Why the Other Options Are Wrong

A: Users who can assume the manager's role effectively hold the manager's permissions, so any restriction applied to the user's own session policy does not reduce the power of the assumed role. It also spreads the manager's credentials across many users rather than centralising them in a product, which is the opposite of the stated goal. C: Granting CloudFormation and S3 API permissions to testers, even with conditions, still exposes the CloudFormation API to them, which is a broad grant for self-service testing, and writing conditional policies scoped to one template across a department is more complex to maintain than a product with a launch constraint. D: Elastic Beanstalk environments are not the CloudFormation template the manager already uses, and granting Elastic Beanstalk permissions means testers can create and configure application environments directly, which is broader than launching an approved, fixed template.

Community Comment Notes

The community voted 100 to 0 for B, and the top-voted comment identified Service Catalog as the answer, with a second explaining that it provides self-service launch, launch constraints, and restricted permissions natively. Other commenters noted simply that Service Catalog is the service designed for centrally governed self-service provisioning.

Official Reference

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/constraints.html

This link opens the official vendor documentation in a new tab.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. 0b43291 👍 1 Answered B
    By using AWS Service Catalog, you can leverage its built-in features for self-service, launch constraints, and restricted permissions, making it the most appropriate solution for allowing testers to launch their own environments while limiting their access to only the necessary resources and actions. The other options have drawbacks or do not fully address the requirements: Option A: Granting users permission to assume the manager's role and restricting permissions through policies can be complex to manage and may still grant broader permissions than desired. Option C: Granting users direct permission to use CloudFormation and S3 APIs, even with conditions, may still provide more access than necessary and increase the risk of unintended actions. Option D: While Elastic Beanstalk can be used to launch environments, it may not provide the same level of control and customization as a CloudFormation template. Additionally, granting Elastic Beanstalk permissions may still provide more access than necessary.
  2. awsaz 👍 6 Answered B
    B is the answer
  3. mifune 👍 1 Answered B
    Service Catalog, answer B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket policy

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide