Examkin

Question

Difficulty: MediumAWS CodePipeline

A developer is configuring a continuous delivery pipeline in AWS CodePipeline in Account A. The pipeline is designed to deploy a web application to an Amazon ECS cluster located in Account B. The pipeline uses an Amazon S3 bucket in Account A as its artifact store. During the deployment phase, the deployment action in Account B fails with an Access Denied error when attempting to read the build artifact from the S3 bucket in Account A. Which configuration change will resolve this issue?

  1. Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS, and update both the S3 bucket policy and the KMS key policy to grant the deployment role in Account B access.Answer
  2. B
    Add the CodePipeline service role ARN from Account A to the trust policy of the Account B deployment role so that Account B can assume the role to access the default AWS managed S3 key.
  3. C
    Store the cross-account S3 access keys as a secure string in AWS Systems Manager Parameter Store in Account A, and configure Parameter Store native automatic rotation to dynamically refresh the credentials.
  4. D
    Move the deployment configuration files from the root of the source repository to a nested subdirectory and update the CodePipeline action settings to reference the new path.

Answer

Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS, and update both the S3 bucket policy and the KMS key policy to grant the deployment role in Account B access.
The correct answer is to configure the S3 bucket in Account A with a customer managed key (CMK) and grant read and decrypt access to the Account B role. AWS CodePipeline stores artifacts in S3. For cross-account deployments, the action in the target account must read these artifacts. Since the default S3 KMS key cannot be shared across AWS accounts, the artifact bucket must be encrypted with a Customer Managed Key, and its policy must trust the target account role.

Step-by-Step Solution

1
Identify the root cause of cross-account artifact decryption failure.
The default AWS managed S3 key (aws/s3) cannot be used for cross-account operations.
AWS managed keys cannot have their key policies modified to grant access to external accounts.
2
Create and configure a Customer Managed Key (CMK) in AWS KMS within Account A.
A CMK is created with a key policy that explicitly grants decrypt permissions to the deployment IAM role in Account B.
A customer managed key allows external accounts to be granted usage permissions.
3
Update the S3 bucket policy in Account A.
The bucket policy allows the deployment IAM role in Account B to perform GetObject operations.
Both S3 resource permissions and KMS key permissions must be satisfied for successful retrieval.

Key Concept

Cross-account artifact access in AWS CodePipeline requires using a customer managed key (CMK) in AWS KMS and granting permissions to the target account's deployment role in both the S3 bucket policy and the KMS key policy.
Rate this question

Topics

AWS CodePipeline

More questions from this topic