Examkin

Question

Difficulty: HardAWS CodePipeline

A developer is configuring a continuous delivery pipeline in AWS CodePipeline in Account A (111122223333111122223333) to automate deployments to Account B (444455556666444455556666) using AWS CloudFormation. The pipeline fails during the Deploy stage with an access denied error when attempting to assume the deployment IAM role in Account B. Additionally, the CloudFormation template must retrieve a database password that requires automatic rotation every 3030 days. Which combination of actions should the developer take to resolve the deployment failure and meet the security requirements?

  1. Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role of Account A to perform the sts:AssumeRole action. Store the database password in AWS Secrets Manager and configure automatic rotation.Answer
  2. B
    Update the permissions policy of the deployment IAM role in Account B to allow the CodePipeline service principal to assume the role. Store the database password in Systems Manager Parameter Store and implement custom rotation logic.
  3. C
    Update the trust policy of the deployment IAM role in Account B to trust the global CodePipeline service principal (codepipeline.amazonaws.com). Store the database password in Systems Manager Parameter Store and enable the parameter rotation policy.
  4. D
    Update the permissions policy of the CodePipeline service role in Account A to allow trust from Account B. Store the database password in AWS Secrets Manager and configure automatic rotation.

Answer

Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role of Account A to perform the sts:AssumeRole action. Store the database password in AWS Secrets Manager and configure automatic rotation.
The correct action is to update the trust policy of the target IAM role in Account B to allow Account A's CodePipeline service role to perform the sts:AssumeRole action, and to store the credentials in AWS Secrets Manager which natively handles automatic rotation. This properly satisfies both cross-account trust requirements and credential lifecycle security rules.

Step-by-Step Solution

1
Configure cross-account IAM role assumption.
The Deploy action in Account A's CodePipeline can now assume the IAM role in Account B to create or update the CloudFormation stack.
To deploy resources across AWS accounts, the CodePipeline service role in the source account must be granted permission to assume a role in the destination account. The destination account's role must trust the source role via its trust policy.
2
Select the correct credential storage service.
AWS Secrets Manager is selected to store the database password.
AWS Secrets Manager provides native, out-of-the-box support for database credential rotation, whereas Systems Manager Parameter Store does not.

Key Concept

Cross-account pipeline deployments and secret rotation management.
Rate this question

Topics

AWS CodePipeline

More questions from this topic