Examkin

Question

Difficulty: Very hardAWS CodePipeline

A developer is configuring a continuous delivery pipeline in AWS CodePipeline within AWS Account A (Tooling Account). The pipeline must build and deploy a serverless application to AWS Account B (Production Account) using AWS CloudFormation. The deployment process requires a sensitive API authentication token that is generated during the build stage and must be rotated automatically on a weekly schedule. The deployment must adhere to the principle of least privilege. Which combination of configuration steps will meet these requirements?

  1. Store the API token in AWS Secrets Manager in Account B and configure a weekly rotation schedule. In Account B, create an IAM role for the pipeline action with a permissions policy allowing AWS CloudFormation deployments and retrieval of the Secrets Manager secret. Edit the trust policy of this IAM role in Account B to allow the CodePipeline service role from Account A to perform sts:AssumeRole. In Account A, configure the pipeline by setting the RoleArn of the CloudFormation deploy action to the ARN of the IAM role in Account B.Answer
  2. B
    Store the API token in AWS Systems Manager Parameter Store in Account B and configure a weekly rotation schedule. In Account B, create an IAM role for the pipeline action with a permissions policy allowing AWS CloudFormation deployments and decryption of the Parameter Store parameter. Edit the trust policy of this IAM role in Account B to allow the CodePipeline service role from Account A to perform sts:AssumeRole. In Account A, configure the pipeline by setting the RoleArn of the CloudFormation deploy action to the ARN of the IAM role in Account B.
  3. C
    Store the API token in AWS Secrets Manager in Account B and configure a weekly rotation schedule. In Account B, create an IAM role for the pipeline action with a trust policy that allows the AWS CloudFormation service principal to assume the role. Attach an IAM permissions policy to this role that allows the CodePipeline service role from Account A to perform sts:AssumeRole. In Account A, configure the pipeline by setting the RoleArn of the CloudFormation deploy action to the ARN of the IAM role in Account B.
  4. D
    Store the API token in AWS Systems Manager Parameter Store in Account B and configure a weekly rotation schedule. In Account B, create an IAM role for the pipeline action with a trust policy that allows the AWS CloudFormation service principal to assume the role. Attach an IAM permissions policy to this role that allows the CodePipeline service role from Account A to perform sts:AssumeRole. In Account A, configure the pipeline by setting the RoleArn of the CloudFormation deploy action to the ARN of the IAM role in Account B.

Answer

Store the API token in AWS Secrets Manager in Account B, configure a weekly rotation schedule, configure the trust policy of the IAM role in Account B to allow CodePipeline in Account A to assume it, and reference this role ARN in the pipeline deploy action.
The correct option correctly identifies that AWS Secrets Manager is required for secrets needing native automatic rotation. It also correctly structures the cross-account deployment permissions: the IAM role in the target deployment account (Account B) must have a trust policy allowing the Tooling Account (Account A) pipeline service role to assume it, and this cross-account role ARN must be specified in the pipeline's deploy action configuration.

Step-by-Step Solution

1
Select the appropriate storage service for a sensitive token that requires automatic rotation.
AWS Secrets Manager is chosen because it natively supports automatic rotation (via AWS Lambda), whereas Systems Manager Parameter Store does not.
Ensures rotation requirements are met natively and cost-effectively without building custom rotation scripts.
2
Configure the cross-account IAM role in Account B (Production Account).
The role is created with permissions to deploy resources via CloudFormation and read the Secrets Manager secret. The trust policy of the role is edited to trust Account A's CodePipeline service role.
To allow cross-account access, the target account's role must trust the source account's principal to perform the sts:AssumeRole action.
3
Configure the CodePipeline action in Account A (Tooling Account).
The CloudFormation deploy action is updated to specify the RoleArn pointing to the IAM role in Account B.
This tells CodePipeline to assume the specified cross-account IAM role in Account B when executing the deploy stage.

Key Concept

Cross-account AWS CodePipeline deployments and secret management with native rotation.
Rate this question

Topics

AWS CodePipeline

More questions from this topic