Examkin

Question

Difficulty: HardAWS CodePipeline

A developer is configuring a cross-account continuous delivery pipeline in AWS CodePipeline. The pipeline resides in Account A and must deploy an application to Account B. The pipeline uses an Amazon S3 bucket in Account A to store deployable artifacts, which must be encrypted using a customer managed key in AWS KMS. Arrange the steps in the correct sequence to configure the cross-account pipeline and its security components so that the deploy action in Account B can successfully access and decrypt the artifacts.

  1. 1In Account A, create a customer managed KMS key and configure its key policy to grant the Account B root principal access to perform cryptographic operations.
  2. 2In Account B, create an IAM deployment role with a trust policy that allows the Account A pipeline execution role to assume it, and attach an inline policy allowing KMS decryption and resource deployment.
  3. 3In Account A, update the S3 artifact bucket policy to grant the ARN of the Account B deployment role permissions to perform s3:Get* and s3:Put* operations.
  4. 4In Account A, edit the pipeline JSON definition to configure the artifact store with the KMS key ID and set the roleArn of the deploy action to the Account B deployment role ARN, then update the pipeline using the AWS CLI.

Answer

The correct sequence of steps to configure the cross-account pipeline is: first, create the customer managed KMS key in Account A; second, create the IAM deployment role in Account B; third, update the S3 artifact bucket policy in Account A to grant access to the Account B role; and finally, update the pipeline JSON definition in Account A to reference these resources.
The correct sequence begins with creating the KMS key in Account A to establish cross-account encryption permissions. Next, the IAM deployment role must be created in Account B so that its ARN exists. With the role created, the S3 bucket policy in Account A can then be updated to reference the role's ARN without causing validation errors. Finally, the pipeline definition is updated to tie the KMS key and the deployment role ARN into the pipeline configuration.

Step-by-Step Solution

1
Create the customer managed KMS key in Account A.
A KMS key is generated, and its policy is updated to grant cross-account permissions to Account B.
This establishes the cryptographic foundation required for securing cross-account artifact sharing, allowing Account B to decrypt pipeline artifacts.
2
Create the IAM deployment role in Account B.
An IAM role is created with a trust policy allowing the Account A pipeline execution role to assume it.
This role is required to perform the deployment in Account B and must be created first so its ARN exists for references in other policies.
3
Update the S3 artifact bucket policy in Account A.
The S3 bucket policy is modified to allow the Account B deployment role access to the artifacts.
AWS S3 validates the existence of IAM principal ARNs when saving bucket policies. The role in Account B must already exist to prevent a validation error.
4
Update the pipeline JSON definition in Account A.
The pipeline is updated with the KMS key associated with the artifact store and the deployment role ARN specified in the deploy action.
This binds the cross-account deployment configuration together, allowing CodePipeline to assume the Account B role during the deployment stage.

Key Concept

Cross-account AWS CodePipeline deployments require a specific ordering of resource creation because IAM role ARNs are validated during the saving of resource-based policies (like S3 bucket policies), and customer managed KMS keys are required for cross-account artifact encryption.
Rate this question

Topics

AWS CodePipeline

More questions from this topic