Examkin

Question

Difficulty: Very hardAWS CodePipeline

A developer is configuring a cross-account deployment pipeline in AWS CodePipeline. The pipeline is located in Account A (the tooling account) and must deploy a containerized application to Amazon ECS in Account B (the target account). The pipeline's artifact store is an Amazon S3 bucket in Account A, which is encrypted with an AWS KMS Customer Managed Key (CMK) also located in Account A.

To successfully configure and run this pipeline, the developer needs to set up the necessary cross-account IAM roles, resource policies, and pipeline action settings.

What is the correct chronological sequence of steps required to successfully configure and execute this cross-account deployment?

  1. 1Create the target deployment IAM role in Account B, specifying a trust policy that allows the CodePipeline service role in Account A to assume it.
  2. 2Update the KMS key policy and S3 bucket policy in Account A to grant the newly created Account B IAM role permission to retrieve and decrypt the pipeline artifacts.
  3. 3Modify the pipeline structure in Account A, setting the 'roleArn' parameter of the deploy action to the Account B IAM role ARN.
  4. 4Start the pipeline execution in Account A, prompting CodePipeline to assume the Account B IAM role and request the artifact from the S3 bucket.
  5. 5Decrypt the artifact using the Customer Managed Key (CMK) in Account A and update the Amazon ECS service in Account B using the assumed role's credentials.

Answer

The correct sequence is: first, create the target deployment IAM role in Account B; second, update the KMS key policy and S3 bucket policy in Account A; third, configure the deploy action in the Account A pipeline; fourth, run the pipeline execution; and fifth, decrypt the artifact and deploy to Amazon ECS in Account B.
The correct sequence begins with creating the IAM role in Account B so that its ARN is valid. Then, policies in Account A (S3 and KMS) are updated to reference this ARN. Next, the pipeline deploy action is modified to use this role. Finally, the pipeline is executed, assuming the role, downloading, and decrypting the artifact to complete the deployment.

Step-by-Step Solution

1
Create the IAM role in Account B with a trust policy for Account A's CodePipeline service role.
The target deployment role exists, establishing a valid ARN for resource policy references.
AWS API validates principal ARNs in resource policies; the role must exist before it can be referenced elsewhere.
2
Update the KMS key policy and S3 bucket policy in Account A.
The Account B role is granted permissions to read from the artifact bucket and decrypt using the CMK.
Allows the cross-account deployment role to access the pipeline's encrypted artifacts.
3
Update the pipeline definition in Account A to specify the deploy action's roleArn.
The deploy action is configured to assume the Account B role during execution.
Tells CodePipeline which role to assume when running the deployment phase.
4
Trigger the pipeline execution.
CodePipeline assumes the Account B role and retrieves the artifact from S3.
Initiates the cross-account action execution workflow.
5
Decrypt the artifact and update the Amazon ECS service.
The application is successfully deployed to Account B.
Executes the final deployment step using the assumed role permissions and decrypted content.

Key Concept

Cross-account pipeline deployments with AWS KMS-encrypted artifact stores require strict ordering of IAM role creation, resource policy configuration (KMS and S3), and pipeline definition updates.
Estimated Time:3m 0s
Rate this question

Topics

AWS CodePipeline

More questions from this topic