Examkin

Question

Difficulty: MediumAWS CodePipeline

A developer is configuring a cross-account continuous delivery pipeline using AWS CodePipeline. The pipeline is created in a Tooling account (111111111111111111111111) and must deploy a serverless application to a Production account (222222222222222222222222) using AWS CloudFormation. The pipeline's deploy action is configured to assume an IAM role (`ProdDeployRole`) in the Production account. During execution, the pipeline fails at the CloudFormation deploy stage with an error stating that the pipeline service role is not authorized to perform `sts:AssumeRole` on `ProdDeployRole`.

Which action should the developer take to resolve this issue?

  1. A
    Attach an identity-based permission policy to the target deployment role in the Production account that allows the Tooling account's CodePipeline service role to perform STS assume role actions, without modifying the trust policy.
  2. B
    Store the deployment configuration parameters in AWS Systems Manager Parameter Store as a Standard parameter in the Tooling account, and configure the CloudFormation deployment action in CodePipeline to reference the parameter directly across accounts.
  3. Configure the trust policy of the target deployment role in the Production account to trust the CodePipeline service role ARN from the Tooling account, and grant the CodePipeline service role in the Tooling account permissions to perform assume role actions on the target role.Answer
  4. D
    Move the CloudFormation configuration template and the build specification file from the root directory of the source repository to a subdirectory named after the deployment stage so CodePipeline can locate them during execution.

Answer

Configure the trust policy of the target deployment role in the Production account to trust the CodePipeline service role ARN from the Tooling account, and grant the CodePipeline service role in the Tooling account permissions to perform assume role actions on the target role.
For cross-account deployments in AWS CodePipeline, a role must be assumed in the destination account. This requires two configurations: the trust policy of the target role in the destination account must trust the pipeline's service role, and the pipeline's service role must have the permission to assume the target role. This establishes the necessary cross-account delegation.

Step-by-Step Solution

1
Inspect the trust relationship of the deployment role (ProdDeployRole) in the destination Production account.
Identify that the trust policy must explicitly allow the 'sts:AssumeRole' action for the IAM service role ARN of AWS CodePipeline in the source Tooling account.
Without this trust relationship, IAM prevents external entities (like the Tooling account service role) from assuming the role.
2
Examine the identity-based permission policy attached to the CodePipeline service role in the Tooling account.
Ensure there is a policy that allows the 'sts:AssumeRole' action on the target role ARN in the Production account.
The initiating service role must have explicit permission to perform the assume role operation on the external resource.
3
Verify that both policies are correctly applied and reference the correct ARNs.
The pipeline execution succeeds at the deploy stage, assuming the target role to deploy the resources.
Both trust and permission policies must align to allow cross-account access delegation.

Key Concept

Cross-account resource deployment using AWS CodePipeline and IAM assume role configurations.
Rate this question

Topics

AWS CodePipeline

More questions from this topic