Examkin

Question

Difficulty: EasyAWS CodePipeline

A developer is configuring a continuous delivery pipeline in AWS CodePipeline. During the pipeline execution, the pipeline fails at the transition to a deployment stage with an access denied error indicating that the pipeline cannot assume the service role. Which of the following is the most likely cause of this failure?

  1. The IAM service role assigned to the pipeline has a trust policy that does not list codepipeline.amazonaws.com as a trusted entity.Answer
  2. B
    The IAM service role lists codepipeline.amazonaws.com in the identity-based permissions policy rather than in the trust policy.
  3. C
    The pipeline is attempting to retrieve a database connection string from Systems Manager Parameter Store, which fails because Parameter Store cannot rotate credentials.
  4. D
    The pipeline is unable to parse the build configuration because the buildspec.yml file is placed in a subdirectory of the source repository rather than the root directory.

Answer

The IAM service role assigned to the pipeline must have a trust policy that explicitly lists codepipeline.amazonaws.com as a trusted entity.
The correct option is correct because AWS CodePipeline requires an IAM service role to execute pipeline actions on your behalf. The service role's trust policy must declare codepipeline.amazonaws.com as a trusted entity so that the pipeline service can assume the role and obtain temporary credentials.

Step-by-Step Solution

1
Analyze the error message regarding the pipeline's inability to assume the designated service role.
Identify that the issue is related to IAM role assumption permissions.
The error specifically mentions that CodePipeline is denied access when attempting to assume the service role.
2
Review the trust policy of the IAM service role assigned to AWS CodePipeline.
Determine if the service principal codepipeline.amazonaws.com is declared as a trusted entity.
Without the correct service principal in the trust policy, the AWS Security Token Service (STS) will block CodePipeline from assuming the role.
3
Verify that the permissions policy is separate from the trust policy.
Ensure permissions policies define resource access, whereas the trust policy dictates who can assume the role.
Misplacing trust declarations in the permissions policy is a common configuration mistake that results in access denied errors.

Key Concept

AWS CodePipeline Service Roles and IAM Trust Policies
Rate this question

Topics

AWS CodePipeline

More questions from this topic