CloudFormation stack deployments fail for some users due to permission inconsistencies. Which combination of steps will ensure consistent deployments MOST securely? (Select THREE.)

To resolve deployment failures from inconsistent user permissions, the best practice is to use an AWS CloudFormation service role. This decouples the deployment's permissions from the user's permissions.

1. First, create an IAM service role with a trust policy that allows the CloudFormation service (cloudformation.amazonaws.com) to assume it (B).

2. To ensure the deployment is "MOST securely" executed, attach tightly scoped IAM policies to this role, granting it only the permissions needed to manage the stack's resources (C). This adheres to the principle of least privilege.

3. Finally, update the CloudFormation stack to use this service role's ARN during create or update operations (E). This ensures all deployments use the same, consistent, and securely-scoped set of permissions.

A. Create a composite principal service role.

This is not a standard AWS IAM term. A service role for CloudFormation requires a specific service principal, not a "composite" one.

D. Attach service ARNs in policy resources.

This is too vague. Policies should contain specific resource ARNs, but "attach scoped policies" (C) is the more accurate and comprehensive description of the security best practice.

F. Allow iam:PassRole to the service role.

This permission is granted to the IAM user or role initiating the deployment, not as a configuration on the service role itself. While necessary for the user, it's not a step in creating the secure role and stack configuration.

1. AWS CloudFormation User Guide, "AWS CloudFormation service roles": "To control the permissions that CloudFormation can exercise, you can use an AWS Identity and Access Management (IAM) service role. When you use a service role, AWS CloudFormation makes calls to other services on your behalf by using the permissions that are granted to the role... To associate a service role with a stack, you specify the role when you create, update, or change sets for the stack." This supports options B and E.

2. AWS IAM User Guide, "Creating a role to delegate permissions to an AWS service": This guide details the process of creating a service role. In the "Select trusted entity" step, you would choose "AWS service" and then "CloudFormation" as the use case, which automatically populates the trust policy with the cloudformation.amazonaws.com service principal. This supports option B.

3. AWS IAM User Guide, "IAM JSON policy elements: Resource": "Use the Resource element to specify the object or objects that the statement covers." and "For the principle of least privilege, you must grant permissions to specific resources." This documentation supports the practice of creating scoped policies (Option C) by specifying resource ARNs.

4. AWS IAM User Guide, "Granting a user permissions to pass a role to an AWS service": "To configure many AWS services, you must pass an IAM role to the service. This allows the service to assume the role later and perform actions on your behalf... To pass a role (and its permissions) to an AWS service, a user must have the iam:PassRole permission." This explains that PassRole is a permission for the user, not a configuration step for the role or stack itself.