Publish the environment as a Service Catalog product with a launch constraint

Prescribe security controls. Design a multi-account AWS environment. Determine a strategy to improve overall operational excellence.
Answer Correct answer: B — Publish the template as a Service Catalog product with a launch constraint using the existing role and grant testers only Service Catalog API access.

A company has an application that uses Amazon EC2 instances in an Auto Scaling group. The quality assurance (QA) department needs to launch a large number of short-lived environments to test the application. The application environments are currently launched by the manager of the department using an AWS CloudFormation template. To launch the stack, the manager uses a role with permission to use CloudFormation, EC2, and Auto Scaling APIs. The manager wants to allow testers to launch their own environments, but does not want to grant broad permissions to each user. Which set up would achieve these goals?

  1. Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to assume the manager’s role and add a policy that restricts the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
  2. Create an AWS Service Catalog product from the environment template. Add a launch constraint to the product with the existing role. Give users in the QA department permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console. Correct Answer
  3. Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to use CloudFormation and S3 APIs, with conditions that restrict the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
  4. Create an AWS Elastic Beanstalk application from the environment template. Give users in the QA department permission to use Elastic Beanstalk permissions only. Train users to launch Elastic Beanstalk environments with the Elastic Beanstalk CLI, passing the existing role to the environment as a service role.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

A Service Catalog launch constraint pins the role used to create the provisioned product, so testers only need permission to call Service Catalog APIs and never receive any of the underlying CloudFormation, EC2, or Auto Scaling permissions themselves.

A QA department needs to launch many short-lived test environments from an existing CloudFormation template, currently done by one manager using a role that can call CloudFormation, EC2, and Auto Scaling. The manager wants testers to self-serve without granting broad permissions to each of them.

Letting users assume the manager's role. Assuming that role grants every permission the role has, and adding a policy on the user's own session to narrow it does not reduce what the assumed role can do, so the effective permissions remain far broader than intended.

Community Discussion (3 comments)

awsaz 👍 6 Selected: B
B is the answer
0b43291 👍 1 Selected: B
By using AWS Service Catalog, you can leverage its built-in features for self-service, launch constraints, and restricted permissions, making it the most appropriate solution for allowing testers to launch their own environments while limiting their access to only the necessary resources and actions. The other options have drawbacks or do not fully address the requirements: Option A: Granting users permission to assume the manager's role and restricting permissions through policies can be complex to manage and may still grant broader permissions than desired. Option C: Granting users direct permission to use CloudFormation and S3 APIs, even with conditions, may still provide more access than necessary and increase the risk of unintended actions. Option D: While Elastic Beanstalk can be used to launch environments, it may not provide the same level of control and customization as a CloudFormation template. Additionally, granting Elastic Beanstalk permissions may still provide more access than necessary.
mifune 👍 1 Selected: B
Service Catalog, answer B

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

AWS Service Catalog is built for exactly this self-service scenario. The environment template is published as a product, and a launch constraint is configured on that product specifying the existing role, so every launch performed by any tester uses that role regardless of who requested it. Testers are then granted permission to use only AWS Service Catalog APIs, which lets them search the catalog and launch the product but gives them no CloudFormation, EC2, or Auto Scaling permissions at all. Because the provisioning role is attached to the product rather than to a user, the permissions model is centrally controlled and testers cannot escalate from the launch capability, and the manager can control what is offered by editing the product.

Why the Other Options Are Wrong

A: Users who can assume the manager's role effectively hold the manager's permissions, so any restriction applied to the user's own session policy does not reduce the power of the assumed role. It also spreads the manager's credentials across many users rather than centralising them in a product, which is the opposite of the stated goal. C: Granting CloudFormation and S3 API permissions to testers, even with conditions, still exposes the CloudFormation API to them, which is a broad grant for self-service testing, and writing conditional policies scoped to one template across a department is more complex to maintain than a product with a launch constraint. D: Elastic Beanstalk environments are not the CloudFormation template the manager already uses, and granting Elastic Beanstalk permissions means testers can create and configure application environments directly, which is broader than launching an approved, fixed template.

Community Comment Notes

The community voted 100 to 0 for B, and the top-voted comment identified Service Catalog as the answer, with a second explaining that it provides self-service launch, launch constraints, and restricted permissions natively. Other commenters noted simply that Service Catalog is the service designed for centrally governed self-service provisioning.

Official Reference

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/constraints.html

Related Analysis

A company is collecting data from a large set of IoT devices

S-Grade

A company hosts an application that uses several Amazon EC2

S-Grade

A solutions architect has deployed a web application that se

A-Grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide