What should the solutions architect do to create the solution?
Upload AWS CloudFormation templates that contain approved resources to an Amazon S3 bucket. Update the IAM policy for the engineers’ IAM role to only allow access to Amazon S3 and AWS CloudFormation. Use AWS CloudFormation templates to provision resources.
Update the IAM policy for the engineers’ IAM role with permissions to only allow provisioning of approved resources and AWS CloudFormation. Use AWS CloudFormation templates to create stacks with approved resources.
Update the IAM policy for the engineers’ IAM role with permissions to only allow AWS CloudFormation actions. Create a new IAM policy with permission to provision approved resources, and assign the policy to a new IAM service role. Assign the IAM service role to AWS CloudFormation during stack creation.
Provision resources in AWS CloudFormation stacks. Update the IAM policy for the engineers’ IAM role to only allow access to their own AWS CloudFormation stack.
Explanations:
This option restricts IAM permissions to Amazon S3 and CloudFormation but does not control which resources can be provisioned within CloudFormation. Engineers could still use non-approved templates for resource provisioning.
While restricting the IAM role permissions to approved resources and CloudFormation, this approach does not enforce template-based restrictions. Engineers could still include non-approved resources within their templates.
This solution limits engineers’ permissions to CloudFormation-only actions, while an IAM service role with specific permissions to approved resources restricts what resources CloudFormation can provision on behalf of engineers.
Restricting access to engineers’ own stacks does not enforce using only approved resources or templates; engineers would still be able to create stacks with unapproved resources within their own stack.
I weigh that the answer is:
Update the IAM policy for the engineers’ IAM role with permissions to only allow AWS CloudFormation actions. Create a new IAM policy with permission to provision approved resources, and assign the policy to a new IAM service role. Assign the IAM service role to AWS CloudFormation during stack creation.