Examkin

Question

Difficulty: HardAWS CodePipeline

A developer is configuring a continuous delivery pipeline in AWS CodePipeline to deploy a serverless web application. The pipeline is created in the us-east-1 region. The release process must deploy AWS CloudFormation stacks to both us-east-1 and us-west-2 during the deployment stage. The pipeline execution fails during the cross-region deployment action because of issues with artifact access between regions. Which two configurations must the developer implement to support this cross-region deployment?

  1. Configure a customer managed AWS KMS key in both the us-east-1 and us-west-2 regions to encrypt and decrypt the deployment artifacts.Answer
  2. Include an Amazon S3 artifact store bucket in each region where a pipeline action is executed within the pipeline definition.Answer
  3. C
    Configure the pipeline to use the default AWS managed S3 key (aws/s3) in each region to automatically handle cross-region artifact encryption.
  4. D
    Store cross-region target deployment credentials in AWS Systems Manager Parameter Store and enable native automatic rotation of the credentials.
  5. E
    Update the IAM trust policy of the CodePipeline service role to allow the AWS CloudFormation service principal to directly assume the role.

Answer

Configure a customer managed AWS KMS key in both the us-east-1 and us-west-2 regions, and include an Amazon S3 artifact store bucket in each region where a pipeline action is executed.
To configure cross-region actions in AWS CodePipeline, a regional S3 artifact store bucket must be configured in each region where actions are executed. Additionally, a customer managed AWS KMS key must be configured in each region to encrypt and decrypt artifacts stored in these regional S3 buckets because default AWS managed keys are not supported for cross-region actions.

Step-by-Step Solution

1
Analyze cross-region action requirements in AWS CodePipeline.
Identify that CodePipeline requires a separate S3 bucket in each region where an action is executed to act as a regional artifact store.
Artifacts must be stored locally in the region of execution to prevent latency and allow regional services to access them.
2
Determine the encryption requirements for cross-region artifact stores.
Identify that a customer managed KMS key must be configured in each region to encrypt and decrypt the artifacts.
Default AWS managed S3 keys (aws/s3) cannot be used for cross-region actions because they cannot be used to decrypt artifacts across regional or account boundaries by the pipeline's service role.
3
Evaluate the distractors against the requirements.
Reject the options proposing default AWS managed S3 keys, Parameter Store for automatic secret rotation, and modifying the CodePipeline trust policy for CloudFormation.
These distractors rely on incorrect assumptions about AWS managed keys, Parameter Store capabilities, and IAM trust relationship delegations.

Key Concept

AWS CodePipeline Cross-Region Action Configurations
Rate this question

Topics

AWS CodePipeline

More questions from this topic