Examkin

All practice questions

14 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 1Question →

A developer is configuring a basic continuous delivery pipeline in AWS CodePipeline to automate software releases. The pipeline must retrieve source code from an AWS CodeCommit repository, compile the project using AWS CodeBuild, and deploy it to an Amazon ECS service using AWS CodeDeploy. Arrange the following steps in the correct chronological order from first to last to complete a single pipeline execution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of pipeline execution is: first, detecting the change in CodeCommit; second, retrieving the source files and storing them in Amazon S3; third, building the application using AWS CodeBuild; and finally, deploying the application to Amazon ECS using AWS CodeDeploy.
A pipeline execution in AWS CodePipeline flows sequentially through stages. First, CodePipeline detects a change in the source repository. Second, the source stage retrieves the code and stores it in Amazon S3 as an input artifact. Third, AWS CodeBuild compiles the code and generates the build output artifact. Lastly, AWS CodeDeploy uses the build artifact to update the Amazon ECS service.

Step-by-Step Solution

1
Detect change in the source repository
Pipeline execution is triggered.
AWS CodePipeline monitors the source repository for changes to start the release process automatically.
2
Retrieve source files and upload to the artifact store
Source artifact is created and stored in the pipeline's Amazon S3 bucket.
The files must be uploaded to the artifact store so they are accessible by downstream actions.
3
Execute the build stage action
A build output artifact is created.
AWS CodeBuild runs compile and packaging steps on the source artifact to generate the deployable artifact.
4
Execute the deploy stage action
The application is updated in the target environment.
AWS CodeDeploy consumes the build output artifact to update the Amazon ECS task definition and service.

Key Concept

AWS CodePipeline execution runs sequentially through stages (Source, Build, Deploy). Each stage processes input artifacts generated by previous stages and produces output artifacts for subsequent stages.
Estimated Time:45s
Question 2Question →

A developer is configuring a cross-account deployment pipeline in AWS CodePipeline. The pipeline is located in Account A (the tooling account) and must deploy a containerized application to Amazon ECS in Account B (the target account). The pipeline's artifact store is an Amazon S3 bucket in Account A, which is encrypted with an AWS KMS Customer Managed Key (CMK) also located in Account A.

To successfully configure and run this pipeline, the developer needs to set up the necessary cross-account IAM roles, resource policies, and pipeline action settings.

What is the correct chronological sequence of steps required to successfully configure and execute this cross-account deployment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, create the target deployment IAM role in Account B; second, update the KMS key policy and S3 bucket policy in Account A; third, configure the deploy action in the Account A pipeline; fourth, run the pipeline execution; and fifth, decrypt the artifact and deploy to Amazon ECS in Account B.
The correct sequence begins with creating the IAM role in Account B so that its ARN is valid. Then, policies in Account A (S3 and KMS) are updated to reference this ARN. Next, the pipeline deploy action is modified to use this role. Finally, the pipeline is executed, assuming the role, downloading, and decrypting the artifact to complete the deployment.

Step-by-Step Solution

1
Create the IAM role in Account B with a trust policy for Account A's CodePipeline service role.
The target deployment role exists, establishing a valid ARN for resource policy references.
AWS API validates principal ARNs in resource policies; the role must exist before it can be referenced elsewhere.
2
Update the KMS key policy and S3 bucket policy in Account A.
The Account B role is granted permissions to read from the artifact bucket and decrypt using the CMK.
Allows the cross-account deployment role to access the pipeline's encrypted artifacts.
3
Update the pipeline definition in Account A to specify the deploy action's roleArn.
The deploy action is configured to assume the Account B role during execution.
Tells CodePipeline which role to assume when running the deployment phase.
4
Trigger the pipeline execution.
CodePipeline assumes the Account B role and retrieves the artifact from S3.
Initiates the cross-account action execution workflow.
5
Decrypt the artifact and update the Amazon ECS service.
The application is successfully deployed to Account B.
Executes the final deployment step using the assumed role permissions and decrypted content.

Key Concept

Cross-account pipeline deployments with AWS KMS-encrypted artifact stores require strict ordering of IAM role creation, resource policy configuration (KMS and S3), and pipeline definition updates.
Estimated Time:3m 0s
Question 3Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline to automate the release of a containerized web application. The pipeline needs to retrieve source code, build a Docker image, deploy the application to Amazon ECS, and verify its status. Arrange the pipeline actions in the correct chronological sequence from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of pipeline actions is: retrieve source code using AWS CodeCommit, build the Docker image using AWS CodeBuild, deploy the application using AWS CodeDeploy, and run integration tests using AWS Lambda.
The correct order follows the standard pipeline design: first obtaining source code (Source), compiling and producing the artifact (Build), deploying the artifact to the target platform (Deploy), and finally validating the live deployment (Test/Invoke).

Step-by-Step Solution

1
Trigger the pipeline by obtaining source files.
Source code is packaged as a source artifact and stored in the CodePipeline artifact bucket.
Subsequent compilation and packaging require access to the raw source code.
2
Pass the source artifact to CodeBuild to construct the build output.
A Docker image is built, pushed to Amazon ECR, and a build artifact containing the task definition template is created.
Deployment actions require a built container image and configuration templates to proceed.
3
Pass the build artifact to CodeDeploy to update Amazon ECS.
The target ECS service initiates a rolling update or green/blue deployment using the new task definition.
The application must be deployed to the runtime environment before it can be verified or accessed by clients.
4
Invoke AWS Lambda to run post-deployment validation tests.
Integration tests run against the live endpoint, and CodePipeline receives a success or failure status signal.
Post-deployment checks verify that the live system behaves correctly after changes are applied.

Key Concept

AWS CodePipeline Stage and Action Sequencing
Question 4Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline. The pipeline has three stages:
1. Source: An Amazon S3 source action.
2. BuildAndTest: A stage containing three actions: a CodeBuild build action with `runOrder: 1`, a CodeBuild linting action with `runOrder: 1`, and a CodeBuild unit test action with `runOrder: 2` that requires the output artifact of the build action.
3. Deploy: An AWS Elastic Beanstalk deploy action.

When a new code revision is uploaded to the Amazon S3 source bucket, in what chronological order does AWS CodePipeline process the actions and transitions for a successful execution? Arrange the steps from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: first, the source action retrieves the revision and uploads it to the artifact store; second, the build and lint actions run concurrently; third, the build action completes and uploads its output artifact; fourth, the unit test action runs using the build output; and finally, the pipeline transitions to the Deploy stage.
AWS CodePipeline processes executions stage-by-stage. Within a stage, actions with the same runOrder value (such as the build and lint actions, both with runOrder 1) are executed in parallel. Actions with a higher runOrder (such as the unit test action with runOrder 2) will wait to execute until all actions with lower runOrder values have successfully completed. Furthermore, any output artifacts required as inputs by subsequent actions must be uploaded before those actions can start. Finally, the pipeline only transitions to the next stage (Deploy) once all actions in the current stage (BuildAndTest) have completed successfully.

Step-by-Step Solution

1
Analyze stage boundaries and action execution sequence.
Identify that the Source stage must complete first, creating the initial source artifact.
AWS CodePipeline is artifact-driven; subsequent stages cannot start without the input artifact from the source stage.
2
Determine execution order of parallel actions in the BuildAndTest stage.
Identify that the build action and linting action run concurrently.
Actions within the same stage that share the same runOrder value (in this case, 1) are executed in parallel.
3
Identify the transition criteria between runOrder levels.
Recognize that the unit test action (runOrder 2) must wait for all runOrder 1 actions to finish and the build output artifact to be uploaded.
CodePipeline executes actions sequentially based on runOrder. An action with runOrder 2 starts only after all runOrder 1 actions complete and its required input artifacts are available.
4
Determine when the stage transitions to the next stage.
Confirm that the Deploy stage starts after the unit test action completes.
A pipeline transition to a subsequent stage occurs only when all actions in the preceding stage have executed successfully.

Key Concept

AWS CodePipeline execution order, action runOrder concurrency, and stage transition logic.
Question 5Question →

A developer is configuring a standard release pipeline in AWS CodePipeline to automate deployment. The pipeline must pull source code from an AWS CodeCommit repository, run tests and compile the code using AWS CodeBuild, require a manual sign-off from the quality assurance team, and finally deploy the application to AWS Elastic Beanstalk.

Arrange the actions in the correct sequence of execution from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions in the pipeline is: Source action (AWS CodeCommit), Build action (AWS CodeBuild), Manual approval action, and Deploy action (AWS Elastic Beanstalk).
AWS CodePipeline processes stages sequentially. The pipeline must first fetch the source code, compile and test it in the build phase, pause for manual verification, and finally deploy the verified package.

Step-by-Step Solution

1
Retrieve the source code from AWS CodeCommit.
The latest revision of the source code is retrieved and package artifacts are created.
Subsequent stages require the source code to perform builds and deployments.
2
Trigger the AWS CodeBuild environment to compile the application and run unit tests.
The application code is verified and a deployment package is generated.
Building the application generates the necessary artifacts that need to be reviewed and deployed.
3
Halt the pipeline for a Manual Approval action.
The pipeline execution pauses, and a notification is sent to the QA team for review.
This guarantees that the built artifacts are verified and approved before they reach the production environment.
4
Deploy the application using the AWS Elastic Beanstalk deployment action.
The verified application version is deployed to the Elastic Beanstalk environment.
Deploying is the final step in the pipeline after the application has been built and approved.

Key Concept

AWS CodePipeline action execution order
Question 6Question →

A developer is configuring an automated build pipeline using AWS CodePipeline. The pipeline is configured to trigger automatically when a ZIP file containing the application source code is uploaded to a specific Amazon S3 bucket, build the application using AWS CodeBuild, and store the output in another bucket. Order the sequence of events that occurs from the developer uploading the ZIP file to the start of the AWS CodeBuild execution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of events starts with the developer uploading the ZIP file to S3, followed by EventBridge detecting the event and triggering CodePipeline, which then downloads the file to the S3 artifact store and subsequently passes it to AWS CodeBuild to start the build.
The correct order follows the event-driven trigger flow: uploading to S3, detection of the S3 event by EventBridge, matching the target rule to trigger CodePipeline, fetching and saving the source code into the pipeline S3 artifact store, and finally starting CodeBuild with the artifact.

Step-by-Step Solution

1
Upload the source code archive to S3.
The S3 object creation event is emitted.
This is the initial action that starts the event-driven workflow.
2
EventBridge detects the S3 object creation event.
The event is captured and evaluated by EventBridge rules.
EventBridge acts as the serverless event router between Amazon S3 and CodePipeline.
3
The matched EventBridge rule triggers CodePipeline.
CodePipeline receives the trigger and starts a new pipeline execution.
The rule target is configured to initiate the execution of the pipeline.
4
CodePipeline runs the Source stage and writes the ZIP file to the artifact store S3 bucket.
The ZIP file is saved as an input artifact.
CodePipeline must store the retrieved source code in its internal artifact store so that downstream actions like CodeBuild can access it.
5
CodePipeline triggers CodeBuild with the input artifact.
CodeBuild receives the source bundle from the artifact store and begins the build.
The Build stage action is executed with the input artifact specified in the pipeline configuration.

Key Concept

AWS CodePipeline S3 and EventBridge Event Integration and Artifact Flow
Estimated Time:1m 30s
Question 7Question →

A developer is implementing a custom build and test action in AWS CodePipeline to integrate a proprietary security scanning tool. The scanning tool runs on an on-premises worker. The developer needs to configure the custom action and set up the worker to retrieve artifacts, perform the scan, and report the results back to the pipeline. What is the correct sequence of steps to configure this custom action workflow and execute it successfully?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with registering the custom action type, configuring it within the pipeline, polling for jobs from the custom worker, acknowledging the job to retrieve credentials and artifact locations, and finally reporting the success result after executing the scan.
The correct sequence begins with registering the custom action type in the AWS account, followed by defining it within the pipeline structure. During execution, the custom worker polls for the job, acknowledges the job to receive the required S3 locations and temporary credentials, performs the tasks, and reports the success result back to CodePipeline.

Step-by-Step Solution

1
Register the custom action type.
The custom action type is created and available for use in the AWS region.
Before a pipeline can reference a custom action, its schema and configuration requirements must be registered using the CLI or CloudFormation.
2
Add the custom action to the pipeline.
The pipeline configuration is updated to include the custom action in a stage.
The custom action must be declared in a stage so that CodePipeline knows when to execute it during the release process.
3
Poll for jobs from the custom worker.
The worker detects a scheduled custom action execution.
Unlike built-in actions, custom actions require an external worker to pull work requests from the CodePipeline service using PollForJobs.
4
Acknowledge the job.
The worker obtains job details, temporary security credentials, and artifact S3 locations.
The worker must notify CodePipeline that it is starting the job. The AcknowledgeJob API response provides the credentials and artifact paths.
5
Execute the task and report success.
The pipeline stage transitions to succeeded after the worker sends the PutJobSuccessResult.
The worker processes the input artifacts, uploads output artifacts to the artifact store, and updates CodePipeline with the final success status.

Key Concept

AWS CodePipeline Custom Actions and Worker Lifecycle APIs
Question 8Question →

A developer is setting up an automated release pipeline in AWS CodePipeline to handle application updates. Arrange the pipeline stages in the correct execution sequence, from the initial trigger to the final production release.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of stages is: first, the Source stage retrieves the source code; second, the Build stage compiles and tests the code; third, the Approval stage pauses the pipeline for verification; and finally, the Deploy stage deploys the artifacts to the target environment.
The correct sequence begins with the Source stage to retrieve raw source files, followed by the Build stage to compile and test the application, then the Approval stage to hold deployment for verification, and finally the Deploy stage to update the live environment.

Step-by-Step Solution

1
Identify the pipeline trigger and source retrieval.
The pipeline execution begins with the Source stage pulling code from the repository.
AWS CodePipeline must first fetch code to generate the primary input artifact.
2
Identify the compilation and test phase.
The Build stage runs to compile code and generate target artifacts.
Source code must be processed and verified before it can be validated or deployed.
3
Identify the manual gatekeeper phase.
The Approval stage pauses the pipeline execution.
An approval step is used to block automatic progression to deployment until verified.
4
Identify the final software release phase.
The Deploy stage deploys the compiled artifacts to the target environment.
The deploy stage runs as the final step in this delivery cycle to update the live application.

Key Concept

AWS CodePipeline execution flow and stage sequencing.
Question 9Question →

An application team wants to automate the deployment of an AWS Serverless Application Model (SAM) project. The workflow requires compiling code, performing security tests, getting manual sign-off from a release manager, and updating a staging stack. The team sets up AWS CodePipeline to coordinate these actions. Arrange the sequence of operations in the correct order that occurs during a single execution of this pipeline, from the detection of a commit to the completion of the stack deployment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, detecting the commit and archiving the source to the S3 artifact bucket; second, running CodeBuild to package the application and upload the output template; third, pausing for manual approval and notifying via SNS; fourth, creating the CloudFormation change set; and fifth, executing the change set to update the staging resources.
The correct execution flow starts with the source step where code is archived in S3. Next, CodeBuild generates the packaged template. Then, the execution pauses for manual approval. Finally, CloudFormation deploys the updates by first creating the change set and then executing it.

Step-by-Step Solution

1
Source detection and storage
The source code is retrieved and uploaded to the Amazon S3 artifact store.
AWS CodePipeline is an artifact-driven service; any pipeline execution must start by fetching the code from the source stage and making it available as an input artifact.
2
Package the application using AWS CodeBuild
A packaged CloudFormation template is written back to the Amazon S3 artifact bucket.
The build stage uses the source input artifact to compile code and package resources, producing a new output artifact for deployment.
3
Halt execution for manual approval
The execution stops, and an Amazon SNS message is published to alert the team.
Manual approval must be placed before deployment actions to prevent unverified artifacts from modifying target environments.
4
Create a CloudFormation change set
CloudFormation processes the packaged template artifact and generates a change set.
A two-step CloudFormation deployment requires creating a change set first to define the differences between the current and proposed stack state.
5
Execute the CloudFormation change set
The stack is updated, deploying the new resource configurations.
Once the change set is generated, it must be executed to apply the actual modifications to the staging environment.

Key Concept

AWS CodePipeline execution lifecycle, stage sequencing, and the separation of CloudFormation deployment steps into creating and executing change sets.
Question 10Question →

A developer is configuring a cross-account continuous delivery pipeline in AWS CodePipeline. The pipeline resides in Account A and must deploy an application to Account B. The pipeline uses an Amazon S3 bucket in Account A to store deployable artifacts, which must be encrypted using a customer managed key in AWS KMS. Arrange the steps in the correct sequence to configure the cross-account pipeline and its security components so that the deploy action in Account B can successfully access and decrypt the artifacts.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps to configure the cross-account pipeline is: first, create the customer managed KMS key in Account A; second, create the IAM deployment role in Account B; third, update the S3 artifact bucket policy in Account A to grant access to the Account B role; and finally, update the pipeline JSON definition in Account A to reference these resources.
The correct sequence begins with creating the KMS key in Account A to establish cross-account encryption permissions. Next, the IAM deployment role must be created in Account B so that its ARN exists. With the role created, the S3 bucket policy in Account A can then be updated to reference the role's ARN without causing validation errors. Finally, the pipeline definition is updated to tie the KMS key and the deployment role ARN into the pipeline configuration.

Step-by-Step Solution

1
Create the customer managed KMS key in Account A.
A KMS key is generated, and its policy is updated to grant cross-account permissions to Account B.
This establishes the cryptographic foundation required for securing cross-account artifact sharing, allowing Account B to decrypt pipeline artifacts.
2
Create the IAM deployment role in Account B.
An IAM role is created with a trust policy allowing the Account A pipeline execution role to assume it.
This role is required to perform the deployment in Account B and must be created first so its ARN exists for references in other policies.
3
Update the S3 artifact bucket policy in Account A.
The S3 bucket policy is modified to allow the Account B deployment role access to the artifacts.
AWS S3 validates the existence of IAM principal ARNs when saving bucket policies. The role in Account B must already exist to prevent a validation error.
4
Update the pipeline JSON definition in Account A.
The pipeline is updated with the KMS key associated with the artifact store and the deployment role ARN specified in the deploy action.
This binds the cross-account deployment configuration together, allowing CodePipeline to assume the Account B role during the deployment stage.

Key Concept

Cross-account AWS CodePipeline deployments require a specific ordering of resource creation because IAM role ARNs are validated during the saving of resource-based policies (like S3 bucket policies), and customer managed KMS keys are required for cross-account artifact encryption.
Question 11Question →

An operations engineer is establishing a continuous deployment workflow for a critical microservice. The pipeline is designed to fetch code from a repository, package the application using AWS CodeBuild, create an AWS CloudFormation change set, require manual intervention for approval, and finally execute the change set.

In what chronological order do these events occur during a successful pipeline execution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The pipeline execution begins with the Source action detecting a commit and uploading the source ZIP file to S3. Next, the Build action downloads this source archive, runs the buildspec, and uploads the compiled package back to S3. Following the build, the first deployment action uses AWS CloudFormation to create a change set. The pipeline then pauses at the Manual Approval action to await user consent. Once approved, the final deployment action executes the CloudFormation change set to update the infrastructure.
The correct chronological sequence starts with the source action retrieving the codebase, followed by CodeBuild compiling and packaging the app. Once packaged, CloudFormation creates a change set so that the proposed infrastructure changes are calculated. The pipeline then pauses at the manual approval stage for verification. Finally, after approval, CloudFormation executes the change set to deploy the resources.

Step-by-Step Solution

1
Trigger pipeline and output source artifact
The Source stage runs, fetching code from the repository and storing it in the Amazon S3 artifact bucket.
AWS CodePipeline requires a source action to pull the source code and produce an input artifact for subsequent stages.
2
Compile and package the application
AWS CodeBuild runs the build stage, compiling code and outputting a packaged application template artifact to S3.
The build stage consumes the source artifact and produces the deployment package required by the deployment actions.
3
Generate the infrastructure change proposal
AWS CloudFormation creates a change set showing what resources will be created, modified, or deleted.
Creating a change set allows developers to review the proposed modifications before they are applied to the live environment.
4
Pause pipeline for manual approval
The pipeline halts transition to the next action, publishes a notification to an SNS topic, and waits for an approval decision.
This manual approval action is configured between the change set creation and execution to enforce gates and human validation.
5
Apply the infrastructure changes
AWS CloudFormation executes the previously created change set, deploying the updates to the stack.
After the manual approval action is approved, the execution resumes and applies the change set.

Key Concept

AWS CodePipeline execution flow, artifact transition, and integration of CloudFormation change sets with manual approvals.
Question 12Question →

A developer is configuring a custom stage action in AWS CodePipeline that invokes an AWS Lambda function to perform integration testing. Arrange the following events in the correct chronological order, from the moment the Lambda action is initiated by the pipeline to the transition of the pipeline to the next stage.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order starts with CodePipeline transitioning the action to In Progress and generating a Job ID, followed by CodePipeline invoking the Lambda function with the payload. Next, the Lambda function executes and retrieves the Job ID, then calls PutJobSuccessResult with the Job ID, and finally, CodePipeline receives the result and transitions the action status to Succeeded.
The correct chronological order starts with CodePipeline generating the Job ID and transitioning the action to In Progress. Next, CodePipeline invokes the Lambda function, passing the Job ID in the event payload. The Lambda function then runs its code, retrieves the Job ID from the event payload, and finishes its tasks. Finally, the function calls the PutJobSuccessResult API with the Job ID, allowing CodePipeline to mark the action as Succeeded and proceed.

Step-by-Step Solution

1
Initiate the action in the pipeline
CodePipeline transitions the Lambda action to In Progress and generates a unique Job ID containing execution details.
AWS CodePipeline manages the lifecycle of the action and creates a tracking Job ID for the execution.
2
Invoke the Lambda function
CodePipeline invokes the Lambda function asynchronously, passing the job event as the JSON payload.
This transfers execution control to the Lambda function and provides the necessary context, including the Job ID.
3
Process the custom logic and parse the event payload
The Lambda function runs its code and extracts the Job ID from the input event object.
The function must have the Job ID in memory to report the outcome back to CodePipeline.
4
Submit the success callback
The Lambda function calls the PutJobSuccessResult API operation using the AWS SDK, referencing the Job ID.
CodePipeline requires an explicit API call (PutJobSuccessResult or PutJobFailureResult) to update the status of the action; otherwise, the stage will hang and eventually time out.
5
Complete the stage transition
CodePipeline transitions the action status to Succeeded and proceeds to the next stage or action.
The received API call confirms the successful completion of the custom action.

Key Concept

AWS CodePipeline integration with AWS Lambda requires the Lambda function to explicitly return a success or failure status by calling the PutJobSuccessResult or PutJobFailureResult API operation using the Job ID provided in the invocation event payload.
Question 13Question →

A development team is integrating an on-premises security scanning tool as a custom action in AWS CodePipeline. A custom worker application runs on-premises and processes the security scanning tasks.

Arrange the steps in the correct chronological order that the custom action worker must execute to process and complete a job in CodePipeline.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The custom worker must first poll for available jobs, acknowledge the retrieved job, process the job by downloading artifacts and running the scan, and finally report the success status back to CodePipeline.
The correct sequence starts with polling for jobs, followed by acknowledging the job to prevent duplicate executions, then downloading the artifacts and running the scan, and finally reporting the success status back to CodePipeline.

Step-by-Step Solution

1
Poll for jobs
The worker receives a job token and details from CodePipeline.
Since the worker is on-premises and CodePipeline cannot initiate connection, the worker must poll CodePipeline for new jobs.
2
Acknowledge the job
The job status is set to in-progress in CodePipeline.
This prevents other worker instances from picking up the same job and verifies that the worker is actively handling it.
3
Process job workloads
Input artifacts are processed, and the security scan runs.
The worker retrieves input artifacts from S3 using the credentials in the job details, then performs the security scan.
4
Put job success result
CodePipeline transitions the stage action to succeeded.
CodePipeline requires an explicit API call to mark the action as complete before it can trigger the next stage.

Key Concept

AWS CodePipeline Custom Actions and the Worker Lifecycle
Estimated Time:1m 30s
Question 14Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline. The pipeline builds a database migration package in AWS CodeBuild and then runs a post-migration check using an AWS Lambda function. The CodeBuild project must retrieve a database password stored as a SecureString in AWS Systems Manager Parameter Store. The Lambda function must report its execution status back to CodePipeline.

Arrange the execution steps in the correct chronological order from start to finish to ensure the pipeline runs successfully without permission or credential failures.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The pipeline first pulls the source code, then CodeBuild retrieves and decrypts the database password from Parameter Store, next the Lambda service assumes the Lambda execution role to run, and finally the Lambda function invokes PutJobSuccessResult to notify CodePipeline of completion.
The correct order requires pulling the source code first, then allowing CodeBuild to assume its service role and decrypt the SecureString from Parameter Store using AWS KMS. After CodeBuild completes, CodePipeline invokes the Lambda function. The Lambda service assumes the execution role (which requires a trust relationship with lambda.amazonaws.com), and once the code runs, the function must explicitly report success to CodePipeline using PutJobSuccessResult.

Step-by-Step Solution

1
Source artifact generation
Source code is successfully fetched and packaged.
AWS CodePipeline requires a source artifact to trigger downstream stages.
2
CodeBuild retrieves secure credentials
The decrypted database password is loaded into CodeBuild's environment.
CodeBuild needs credentials to run the migration; the CodeBuild service role must have permissions to decrypt the KMS key used by the SecureString parameter.
3
Lambda function execution
The Lambda service assumes the execution role and runs the verification code.
The Lambda execution role must trust the lambda.amazonaws.com service principal to execute the code.
4
CodePipeline status notification
CodePipeline receives a success result and completes the action.
Asynchronous Lambda actions in CodePipeline do not auto-complete; they require a PutJobSuccessResult call to advance the pipeline.

Key Concept

AWS CodePipeline execution flow, secure parameter retrieval, and service role trust configurations.
Estimated Time:1m 30s
All practice questions — AWS Certified Developer - Associate | Examkin