Examkin

Question

Difficulty: HardAWS CodePipeline

A developer is configuring a cross-account continuous delivery pipeline in AWS CodePipeline. The pipeline is hosted in Account A and is designed to deploy a serverless application to Account B using AWS CloudFormation. The pipeline uses an Amazon S3 bucket in Account A to store pipeline artifacts. The deployment action in the Deploy stage fails with an error indicating that the CloudFormation role in Account B cannot access the deployment artifacts in the S3 bucket in Account A. The S3 bucket is currently encrypted using the default AWS managed key (aws/s3). Which configuration change is required to resolve this issue and allow successful deployment?

  1. Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS. Update the KMS key policy and the S3 bucket policy in Account A to grant read permissions to the CloudFormation execution role in Account B, and grant the role permissions to decrypt the KMS key.Answer
  2. B
    Modify the trust policy of the CloudFormation execution role in Account B to directly allow the AWS CodePipeline service principal (codepipeline.amazonaws.com) to assume the role, and attach an inline policy to the role allowing S3 read actions on the Account A bucket.
  3. C
    Configure the pipeline to store the build artifacts and deployment templates in AWS Systems Manager Parameter Store as SecureString parameters, and configure the CloudFormation action in Account B to retrieve them.
  4. D
    Move the buildspec.yml file in the source repository from the root directory to the subdirectory containing the CloudFormation templates, and specify this new path in the CodePipeline deploy action settings.

Answer

Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS. Update the KMS key policy and the S3 bucket policy in Account A to grant read permissions to the CloudFormation execution role in Account B, and grant the role permissions to decrypt the KMS key.
For cross-account deployments in AWS CodePipeline, the deployment action in the target account must access the artifact S3 bucket in the source account. When using KMS encryption for the S3 bucket, you cannot use the default AWS-managed key (aws/s3) because its key policy cannot be modified to grant access to external accounts. A Customer Managed Key (CMK) must be created in the source account, and its key policy, along with the S3 bucket policy, must grant permissions to the target account's deployment role. The target role must also have permission to decrypt using that KMS key.

Step-by-Step Solution

1
Identify the cause of the cross-account S3 access failure.
The S3 bucket uses the default AWS-managed key (aws/s3) for encryption, which cannot be shared across different AWS accounts.
AWS-managed KMS keys do not allow modifications to their key policies to trust other AWS accounts.
2
Create and configure a Customer Managed Key (CMK) in AWS KMS.
A CMK is created in Account A with a key policy that allows the CloudFormation execution role in Account B to perform kms:Decrypt actions.
A Customer Managed Key allows policy customization, making it possible to grant cross-account decryption capabilities.
3
Update the S3 bucket policy and associate the CMK with the S3 bucket.
The S3 bucket in Account A is configured to use the new CMK, and its bucket policy is updated to allow S3 read actions (s3:GetObject, s3:GetBucketLocation) from the CloudFormation role in Account B.
Both the KMS key policy and the S3 bucket policy must allow cross-account access for the target role to successfully retrieve the artifacts.

Key Concept

Cross-account AWS CodePipeline S3 artifact access using KMS Customer Managed Keys (CMK)
Rate this question

Topics

AWS CodePipeline

More questions from this topic