Examkin

AWS CodePipeline

47 questions

All types47Multiple choice23Multiple select10Ordering14
Question 21Question →

A developer is configuring an automated build pipeline using AWS CodePipeline. The pipeline is configured to trigger automatically when a ZIP file containing the application source code is uploaded to a specific Amazon S3 bucket, build the application using AWS CodeBuild, and store the output in another bucket. Order the sequence of events that occurs from the developer uploading the ZIP file to the start of the AWS CodeBuild execution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of events starts with the developer uploading the ZIP file to S3, followed by EventBridge detecting the event and triggering CodePipeline, which then downloads the file to the S3 artifact store and subsequently passes it to AWS CodeBuild to start the build.
The correct order follows the event-driven trigger flow: uploading to S3, detection of the S3 event by EventBridge, matching the target rule to trigger CodePipeline, fetching and saving the source code into the pipeline S3 artifact store, and finally starting CodeBuild with the artifact.

Step-by-Step Solution

1
Upload the source code archive to S3.
The S3 object creation event is emitted.
This is the initial action that starts the event-driven workflow.
2
EventBridge detects the S3 object creation event.
The event is captured and evaluated by EventBridge rules.
EventBridge acts as the serverless event router between Amazon S3 and CodePipeline.
3
The matched EventBridge rule triggers CodePipeline.
CodePipeline receives the trigger and starts a new pipeline execution.
The rule target is configured to initiate the execution of the pipeline.
4
CodePipeline runs the Source stage and writes the ZIP file to the artifact store S3 bucket.
The ZIP file is saved as an input artifact.
CodePipeline must store the retrieved source code in its internal artifact store so that downstream actions like CodeBuild can access it.
5
CodePipeline triggers CodeBuild with the input artifact.
CodeBuild receives the source bundle from the artifact store and begins the build.
The Build stage action is executed with the input artifact specified in the pipeline configuration.

Key Concept

AWS CodePipeline S3 and EventBridge Event Integration and Artifact Flow
Estimated Time:1m 30s
Question 22Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline to deploy a serverless web application. The pipeline is created in the us-east-1 region. The release process must deploy AWS CloudFormation stacks to both us-east-1 and us-west-2 during the deployment stage. The pipeline execution fails during the cross-region deployment action because of issues with artifact access between regions. Which two configurations must the developer implement to support this cross-region deployment?

Select all that apply

Show answer & explanation

Answer: Configure a customer managed AWS KMS key in both the us-east-1 and us-west-2 regions to encrypt and decrypt the deployment artifacts.; Include an Amazon S3 artifact store bucket in each region where a pipeline action is executed within the pipeline definition.

Answer

Configure a customer managed AWS KMS key in both the us-east-1 and us-west-2 regions, and include an Amazon S3 artifact store bucket in each region where a pipeline action is executed.
To configure cross-region actions in AWS CodePipeline, a regional S3 artifact store bucket must be configured in each region where actions are executed. Additionally, a customer managed AWS KMS key must be configured in each region to encrypt and decrypt artifacts stored in these regional S3 buckets because default AWS managed keys are not supported for cross-region actions.

Step-by-Step Solution

1
Analyze cross-region action requirements in AWS CodePipeline.
Identify that CodePipeline requires a separate S3 bucket in each region where an action is executed to act as a regional artifact store.
Artifacts must be stored locally in the region of execution to prevent latency and allow regional services to access them.
2
Determine the encryption requirements for cross-region artifact stores.
Identify that a customer managed KMS key must be configured in each region to encrypt and decrypt the artifacts.
Default AWS managed S3 keys (aws/s3) cannot be used for cross-region actions because they cannot be used to decrypt artifacts across regional or account boundaries by the pipeline's service role.
3
Evaluate the distractors against the requirements.
Reject the options proposing default AWS managed S3 keys, Parameter Store for automatic secret rotation, and modifying the CodePipeline trust policy for CloudFormation.
These distractors rely on incorrect assumptions about AWS managed keys, Parameter Store capabilities, and IAM trust relationship delegations.

Key Concept

AWS CodePipeline Cross-Region Action Configurations
Question 23Question →

A developer is configuring a CI/CD pipeline in AWS CodePipeline. The pipeline consists of a Source stage, a Build stage running AWS CodeBuild, and a Deploy stage running AWS CloudFormation. During the Build stage, CodeBuild executes a script that generates a dynamic configuration token required by the CloudFormation template as a parameter named ConfigToken. The pipeline must support concurrent executions without resource state conflicts, out-of-band credential dependencies, or exposure of sensitive data. Which configuration should the developer implement to pass this dynamic token to the CloudFormation deployment action?

Show answer & explanation

Answer: Define ConfigToken under exported-variables in the env section of the CodeBuild buildspec.yml and assign the value during the build phase. Set a Namespace (e.g., BuildVariables) in the CodePipeline build action, and configure the CloudFormation Deploy action ParameterOverrides using the format {"ConfigToken": "#{BuildVariables.ConfigToken}"}.

Answer

Define the ConfigToken under exported-variables in the env section of the buildspec.yml, set a Namespace on the CodePipeline build action, and reference it in the CloudFormation ParameterOverrides using the format {"ConfigToken": "#{BuildVariables.ConfigToken}"}.
The correct option is to define ConfigToken under exported-variables in the env section of the CodeBuild buildspec.yml, assign a Namespace to the Build action, and configure the CloudFormation ParameterOverrides using the syntax #{Namespace.Variable}. CodePipeline natively supports variable sharing across actions using execution namespaces. Each execution has its own runtime scope, which ensures that concurrent pipeline runs remain isolated and do not overwrite each other's data.

Step-by-Step Solution

1
Export the variable in CodeBuild
ConfigToken is defined under the exported-variables key in the buildspec's env section.
This registers the variable with AWS CodeBuild, making it eligible to be captured by AWS CodePipeline upon build completion.
2
Assign a namespace to the Build action
The Build stage action configuration is updated with a Namespace property (e.g., BuildVariables).
Creating a namespace allows other actions within the same pipeline execution path to access the output variables of this specific action.
3
Reference the namespace variable in the CloudFormation action
The ParameterOverrides parameter is set to reference the variable using #{BuildVariables.ConfigToken}.
CodePipeline dynamically interpolates variables using the #{Namespace.VariableName} format during execution, ensuring isolation and supporting concurrency.

Key Concept

AWS CodePipeline variables and namespaces
Question 24Question →

A company is using AWS CodePipeline to automate their deployment process. The pipeline includes a deploy stage that triggers a custom AWS Lambda action to run database migrations against an Amazon RDS MySQL DB instance located in a private subnet. The migration script requires database credentials that must be rotated automatically every 14 days, as well as a non-sensitive database endpoint port number. During execution, the custom Lambda action fails. Which configuration should the developer implement to allow the Lambda function to securely run the migrations while optimizing for operational overhead, cost, and security?

Show answer & explanation

Answer: Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway. Retrieve the database credentials from AWS Secrets Manager and the database port from AWS Systems Manager Parameter Store. Attach a permissions policy to the Lambda execution role allowing secretsmanager:GetSecretValue and ssm:GetParameter, and ensure the role's trust policy allows the lambda.amazonaws.com service principal to assume the role.

Answer

Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway, retrieving the credentials from AWS Secrets Manager and the port from AWS Systems Manager Parameter Store, while attaching the appropriate permissions policy and a trust policy allowing lambda.amazonaws.com to assume the role.
The correct configuration deploys the Lambda function in private VPC subnets alongside a NAT Gateway to permit egress access to both the RDS database and AWS public service endpoints. By retrieving the database credentials from AWS Secrets Manager, the developer secures the credentials and can leverage automatic secret rotation. Using Systems Manager Parameter Store for the database port optimizes cost for non-sensitive configurations. Finally, creating a permissions policy for the AWS actions and maintaining a trust policy that allows the Lambda service principal to assume the role complies with the AWS IAM model.

Step-by-Step Solution

1
Determine the network topology for the database migration Lambda function.
The Lambda function must be placed in private VPC subnets with a route to a NAT Gateway to access the private RDS DB instance and reach public AWS endpoints for Secrets Manager and Parameter Store.
Since the RDS MySQL instance is in a private subnet, the Lambda function needs to be in the same VPC to communicate with it, and it needs a NAT Gateway to call AWS API endpoints.
2
Select the correct secrets and parameter storage services based on requirements.
Store database credentials in AWS Secrets Manager and the database port in Systems Manager Parameter Store.
AWS Secrets Manager is required because it natively supports automatic rotation every 14 days. Systems Manager Parameter Store is used for the non-sensitive port number to minimize costs.
3
Configure the Lambda execution role policies.
Attach a permissions policy allowing secretsmanager:GetSecretValue and ssm:GetParameter. Ensure the trust policy allows lambda.amazonaws.com to assume the role.
The permissions policy governs what resources the role can access, while the trust policy specifies that the Lambda service itself is permitted to assume the role during execution.

Key Concept

Integration of AWS CodePipeline custom actions with VPC network configurations, AWS Secrets Manager, Systems Manager Parameter Store, and IAM role trust/permissions separation.
Estimated Time:2m 0s
Question 25Question →

A developer is setting up a basic release pipeline using AWS CodePipeline to compile a containerized application and deploy it to Amazon Elastic Container Service (Amazon ECS). The source code is stored in an AWS CodeCommit repository. Which of the following configurations are required to successfully set up this pipeline? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a Source action in AWS CodePipeline with AWS CodeCommit as the source provider.; Configure a Build action in AWS CodePipeline with AWS CodeBuild as the build provider.

Answer

To configure the release pipeline, the developer must add a Source action with AWS CodeCommit as the provider and a Build action with AWS CodeBuild as the provider.
The correct configurations are configuring a Source action with AWS CodeCommit as the source provider and configuring a Build action with AWS CodeBuild as the build provider. The Source action triggers the pipeline when changes are detected in the repository, and the Build action compiles the containerized application and packages it as a Docker image.

Step-by-Step Solution

1
Define the Source stage.
The pipeline is configured with a Source stage that references the AWS CodeCommit repository to pull the code on changes.
AWS CodePipeline requires a source repository to fetch the code before running subsequent compilation or build actions.
2
Define the Build stage.
The pipeline is configured with a Build stage that uses AWS CodeBuild to execute the compilation and Docker image build steps.
An AWS CodeBuild action is necessary to compile the containerized application code and package it as a Docker image.

Key Concept

AWS CodePipeline Stages and Actions
Question 26Question →

A developer is configuring a release pipeline in AWS CodePipeline. The developer wants to pause the pipeline before the deployment stage to allow a team lead to review the changes, and wants the team lead to receive an email notification when the pipeline is paused. Which configuration should the developer use to meet these requirements?

Show answer & explanation

Answer: Add a Manual Approval action to the pipeline before the deployment stage, and configure it with an Amazon Simple Notification Service (Amazon SNS) topic ARN.

Answer

Add a Manual Approval action to the pipeline before the deployment stage, and configure it with an Amazon Simple Notification Service (Amazon SNS) topic ARN.
The correct option adds a Manual Approval action directly into the pipeline stage before the deployment stage. By associating the action with an Amazon SNS topic ARN, CodePipeline automatically sends a notification to the subscribed email address of the team lead when the action runs, pausing the pipeline until the approval is granted or rejected.

Step-by-Step Solution

1
Identify the requirement to pause the pipeline and notify a reviewer.
The developer needs a mechanism to halt pipeline execution and send an email notification.
AWS CodePipeline provides a native action category called 'Approval' to pause the pipeline.
2
Select the correct action type and configuration details.
A Manual Approval action is added to a pipeline stage. It can be configured with an Amazon SNS topic.
The SNS topic publishes messages to its subscribers (such as email endpoints) to alert reviewers that an approval is pending.

Key Concept

AWS CodePipeline Manual Approval Actions
Estimated Time:45s
Question 27Question →

A developer is configuring a cross-account continuous delivery pipeline using AWS CodePipeline. The pipeline is created in a Tooling account (111111111111111111111111) and must deploy a serverless application to a Production account (222222222222222222222222) using AWS CloudFormation. The pipeline's deploy action is configured to assume an IAM role (`ProdDeployRole`) in the Production account. During execution, the pipeline fails at the CloudFormation deploy stage with an error stating that the pipeline service role is not authorized to perform `sts:AssumeRole` on `ProdDeployRole`.

Which action should the developer take to resolve this issue?

Show answer & explanation

Answer: Configure the trust policy of the target deployment role in the Production account to trust the CodePipeline service role ARN from the Tooling account, and grant the CodePipeline service role in the Tooling account permissions to perform assume role actions on the target role.

Answer

Configure the trust policy of the target deployment role in the Production account to trust the CodePipeline service role ARN from the Tooling account, and grant the CodePipeline service role in the Tooling account permissions to perform assume role actions on the target role.
For cross-account deployments in AWS CodePipeline, a role must be assumed in the destination account. This requires two configurations: the trust policy of the target role in the destination account must trust the pipeline's service role, and the pipeline's service role must have the permission to assume the target role. This establishes the necessary cross-account delegation.

Step-by-Step Solution

1
Inspect the trust relationship of the deployment role (ProdDeployRole) in the destination Production account.
Identify that the trust policy must explicitly allow the 'sts:AssumeRole' action for the IAM service role ARN of AWS CodePipeline in the source Tooling account.
Without this trust relationship, IAM prevents external entities (like the Tooling account service role) from assuming the role.
2
Examine the identity-based permission policy attached to the CodePipeline service role in the Tooling account.
Ensure there is a policy that allows the 'sts:AssumeRole' action on the target role ARN in the Production account.
The initiating service role must have explicit permission to perform the assume role operation on the external resource.
3
Verify that both policies are correctly applied and reference the correct ARNs.
The pipeline execution succeeds at the deploy stage, assuming the target role to deploy the resources.
Both trust and permission policies must align to allow cross-account access delegation.

Key Concept

Cross-account resource deployment using AWS CodePipeline and IAM assume role configurations.
Question 28Question →

A developer is implementing a custom build and test action in AWS CodePipeline to integrate a proprietary security scanning tool. The scanning tool runs on an on-premises worker. The developer needs to configure the custom action and set up the worker to retrieve artifacts, perform the scan, and report the results back to the pipeline. What is the correct sequence of steps to configure this custom action workflow and execute it successfully?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with registering the custom action type, configuring it within the pipeline, polling for jobs from the custom worker, acknowledging the job to retrieve credentials and artifact locations, and finally reporting the success result after executing the scan.
The correct sequence begins with registering the custom action type in the AWS account, followed by defining it within the pipeline structure. During execution, the custom worker polls for the job, acknowledges the job to receive the required S3 locations and temporary credentials, performs the tasks, and reports the success result back to CodePipeline.

Step-by-Step Solution

1
Register the custom action type.
The custom action type is created and available for use in the AWS region.
Before a pipeline can reference a custom action, its schema and configuration requirements must be registered using the CLI or CloudFormation.
2
Add the custom action to the pipeline.
The pipeline configuration is updated to include the custom action in a stage.
The custom action must be declared in a stage so that CodePipeline knows when to execute it during the release process.
3
Poll for jobs from the custom worker.
The worker detects a scheduled custom action execution.
Unlike built-in actions, custom actions require an external worker to pull work requests from the CodePipeline service using PollForJobs.
4
Acknowledge the job.
The worker obtains job details, temporary security credentials, and artifact S3 locations.
The worker must notify CodePipeline that it is starting the job. The AcknowledgeJob API response provides the credentials and artifact paths.
5
Execute the task and report success.
The pipeline stage transitions to succeeded after the worker sends the PutJobSuccessResult.
The worker processes the input artifacts, uploads output artifacts to the artifact store, and updates CodePipeline with the final success status.

Key Concept

AWS CodePipeline Custom Actions and Worker Lifecycle APIs
Question 29Question →

A developer is setting up an automated release pipeline in AWS CodePipeline to handle application updates. Arrange the pipeline stages in the correct execution sequence, from the initial trigger to the final production release.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of stages is: first, the Source stage retrieves the source code; second, the Build stage compiles and tests the code; third, the Approval stage pauses the pipeline for verification; and finally, the Deploy stage deploys the artifacts to the target environment.
The correct sequence begins with the Source stage to retrieve raw source files, followed by the Build stage to compile and test the application, then the Approval stage to hold deployment for verification, and finally the Deploy stage to update the live environment.

Step-by-Step Solution

1
Identify the pipeline trigger and source retrieval.
The pipeline execution begins with the Source stage pulling code from the repository.
AWS CodePipeline must first fetch code to generate the primary input artifact.
2
Identify the compilation and test phase.
The Build stage runs to compile code and generate target artifacts.
Source code must be processed and verified before it can be validated or deployed.
3
Identify the manual gatekeeper phase.
The Approval stage pauses the pipeline execution.
An approval step is used to block automatic progression to deployment until verified.
4
Identify the final software release phase.
The Deploy stage deploys the compiled artifacts to the target environment.
The deploy stage runs as the final step in this delivery cycle to update the live application.

Key Concept

AWS CodePipeline execution flow and stage sequencing.
Question 30Question →

A developer is setting up an AWS CodePipeline to deploy a serverless application. The pipeline includes a deploy stage that triggers a custom AWS Lambda action to run database schema migrations. The Lambda action requires access to database credentials, and the pipeline itself must have permission to invoke the Lambda function. Which two of the following configuration steps should the developer perform to meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and retrieve them programmatically within the Lambda function.; Configure the trust policy of the IAM role associated with AWS CodePipeline to allow the codepipeline.amazonaws.com service principal to assume the role.

Answer

The correct steps are to store the database credentials in AWS Secrets Manager and to configure the trust policy of the IAM role associated with AWS CodePipeline to allow the CodePipeline service principal to assume the role.
Storing database credentials in AWS Secrets Manager is the correct practice because Secrets Manager encrypts the credentials at rest and supports automatic rotation. Additionally, the AWS CodePipeline service role requires a trust policy (also known as an assume role policy) that allows the CodePipeline service principal to assume the role in order to perform pipeline actions.

Step-by-Step Solution

1
Identify the correct storage service for database credentials.
AWS Secrets Manager is chosen for credential storage.
Secrets Manager encrypts credentials at rest and supports automatic rotation, meeting security requirements.
2
Configure permissions for CodePipeline execution.
The trust policy of the CodePipeline service role is configured to allow the codepipeline.amazonaws.com service principal to assume the role.
This trust relationship is necessary for CodePipeline to assume the role and execute the deployment steps.

Key Concept

AWS CodePipeline Custom Actions and IAM Roles
Question 31Question →

A developer is configuring a continuous delivery pipeline using AWS CodePipeline in Account A. The pipeline needs to deploy a serverless application to Account B using AWS CloudFormation. The developer has created a deployment IAM role in Account B with the required permissions to create and manage the application resources. However, when the pipeline runs, the CloudFormation deployment stage fails with an Access Denied error. Which of the following configurations will resolve this issue?

Show answer & explanation

Answer: Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role in Account A to assume it, and configure the CloudFormation action in Account A's pipeline to use this cross-account role.

Answer

Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role in Account A to assume it, and configure the CloudFormation action in Account A's pipeline to use this cross-account role.
The correct option correctly configures cross-account authorization. AWS CodePipeline supports executing actions in another account by assuming a role created in that account. The role in the target account must trust the CodePipeline service role to perform the 'sts:AssumeRole' action, and the pipeline action configuration must specify the target role ARN.

Step-by-Step Solution

1
Modify the trust policy of the IAM role in Account B (target account) to add a trust relationship allowing the 'sts:AssumeRole' action for the CodePipeline service role ARN from Account A.
The IAM role in the target account is now allowed to be assumed by the CodePipeline service role in the source account.
This establishes cross-account trust required for secure delegation of authority.
2
Update the CodePipeline action configuration in the deployment stage in Account A to reference the IAM role ARN from Account B under the 'RoleArn' parameter.
CodePipeline is configured to assume the target account role when executing the CloudFormation action.
This instructs CodePipeline to use the trusted target account role's temporary credentials for deployment.

Key Concept

Cross-account deployments in AWS CodePipeline require configuring IAM trust policies that allow the pipeline service role to assume a target deployment role in the destination account.
Estimated Time:1m 30s
Question 32Question →

A developer is configuring a test stage in AWS CodePipeline that invokes an AWS Lambda function to run integration tests against an Amazon RDS database. The Lambda function requires access to the database credentials and must inform CodePipeline of the test execution results so the pipeline can proceed or halt. Which configuration steps should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret.; Program the Lambda function to parse the job ID from the event payload and invoke PutJobSuccessResult or PutJobFailureResult to report the outcome to CodePipeline.

Answer

Store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret. Program the Lambda function to parse the job ID from the event payload and invoke PutJobSuccessResult or PutJobFailureResult to report the outcome to CodePipeline.
The correct steps involve securely managing credentials and properly signaling CodePipeline. Storing database credentials in AWS Secrets Manager is secure and supports automatic rotation. Additionally, AWS CodePipeline expects any invoked Lambda action to notify it of success or failure by calling PutJobSuccessResult or PutJobFailureResult using the job ID extracted from the event payload.

Step-by-Step Solution

1
Analyze how AWS CodePipeline interacts with custom Lambda actions.
The Lambda function receives a job details payload from CodePipeline containing a unique job ID.
This job ID is required to notify CodePipeline of the action's success or failure using the appropriate API calls.
2
Implement the completion signaling logic inside the Lambda function.
The Lambda code calls PutJobSuccessResult on success or PutJobFailureResult on failure, passing the job ID.
If the Lambda function does not send this signal, CodePipeline will remain in the 'InProgress' state until the action times out.
3
Evaluate options for secure credential retrieval.
Database credentials should be stored in AWS Secrets Manager, and the Lambda execution role must be granted permissions to retrieve them.
This ensures the credentials are encrypted, not hardcoded in the codebase, and can be rotated automatically.

Key Concept

AWS CodePipeline integration with AWS Lambda requires the Lambda function to explicitly return status using the PutJobSuccessResult or PutJobFailureResult API, and secrets should be managed securely using AWS Secrets Manager.
Estimated Time:2m 0s
Question 33Question →

An application team wants to automate the deployment of an AWS Serverless Application Model (SAM) project. The workflow requires compiling code, performing security tests, getting manual sign-off from a release manager, and updating a staging stack. The team sets up AWS CodePipeline to coordinate these actions. Arrange the sequence of operations in the correct order that occurs during a single execution of this pipeline, from the detection of a commit to the completion of the stack deployment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, detecting the commit and archiving the source to the S3 artifact bucket; second, running CodeBuild to package the application and upload the output template; third, pausing for manual approval and notifying via SNS; fourth, creating the CloudFormation change set; and fifth, executing the change set to update the staging resources.
The correct execution flow starts with the source step where code is archived in S3. Next, CodeBuild generates the packaged template. Then, the execution pauses for manual approval. Finally, CloudFormation deploys the updates by first creating the change set and then executing it.

Step-by-Step Solution

1
Source detection and storage
The source code is retrieved and uploaded to the Amazon S3 artifact store.
AWS CodePipeline is an artifact-driven service; any pipeline execution must start by fetching the code from the source stage and making it available as an input artifact.
2
Package the application using AWS CodeBuild
A packaged CloudFormation template is written back to the Amazon S3 artifact bucket.
The build stage uses the source input artifact to compile code and package resources, producing a new output artifact for deployment.
3
Halt execution for manual approval
The execution stops, and an Amazon SNS message is published to alert the team.
Manual approval must be placed before deployment actions to prevent unverified artifacts from modifying target environments.
4
Create a CloudFormation change set
CloudFormation processes the packaged template artifact and generates a change set.
A two-step CloudFormation deployment requires creating a change set first to define the differences between the current and proposed stack state.
5
Execute the CloudFormation change set
The stack is updated, deploying the new resource configurations.
Once the change set is generated, it must be executed to apply the actual modifications to the staging environment.

Key Concept

AWS CodePipeline execution lifecycle, stage sequencing, and the separation of CloudFormation deployment steps into creating and executing change sets.
Question 34Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline that deploys a serverless application using AWS CloudFormation. The pipeline needs to pass a database password to the CloudFormation deploy stage. The database password must be rotated automatically every 30 days to comply with company security policies. Additionally, the CloudFormation action in CodePipeline must assume a specific deployment IAM role in the production account to create and update resources. Which configuration should the developer implement to meet these requirements securely and with the least operational overhead?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and enable automatic rotation. In the deployment IAM role, configure the trust policy to allow the CodePipeline service principal to assume the role.

Answer

Store the database password in AWS Secrets Manager and enable automatic rotation. In the deployment IAM role, configure the trust policy to allow the CodePipeline service principal to assume the role.
The correct configuration uses AWS Secrets Manager for secret storage because it offers built-in automatic rotation. In addition, to allow AWS CodePipeline to assume the deployment IAM role, the trust policy of the deployment role must be updated to allow the CodePipeline service principal to assume it. This satisfies all requirements with minimal operational overhead.

Step-by-Step Solution

1
Identify the database password rotation requirement.
Determine that AWS Secrets Manager is the correct service because it natively supports automatic rotation, unlike Systems Manager Parameter Store.
Parameter Store lacks native, automated rotation, which would require custom Lambda scripts, adding operational overhead.
2
Determine the required trust relationship for the deployment role.
Identify that the CloudFormation deployment IAM role needs to trust the CodePipeline service principal (codepipeline.amazonaws.com).
The deployment role must allow CodePipeline to assume it via a trust policy, which is distinct from a permissions policy.
3
Combine both configurations.
Choose the configuration that stores the secret in Secrets Manager and correctly modifies the trust policy of the deployment role.
This ensures both security compliance for secret rotation and correct delegation of IAM permissions.

Key Concept

Integrating AWS CodePipeline with AWS Secrets Manager and cross-account or cross-action IAM roles.
Question 35Question →

A developer is configuring a multi-stage release pipeline in AWS CodePipeline. The first stage contains a Source action that retrieves code from an AWS CodeCommit repository, and the developer has assigned the namespace `SourceVariables` to this action. In a downstream Deploy stage, the developer wants to reference the specific commit ID that triggered the pipeline execution to dynamic-tag the deployment resources. Which of the following is the correct method to pass this commit ID variable from the Source stage to the Deploy stage?

Show answer & explanation

Answer: Configure the Deploy action to reference the variable using the syntax `#{SourceVariables.CommitId}` in its configuration parameters.

Answer

Configure the Deploy action to reference the variable using the syntax `#{SourceVariables.CommitId}` in its configuration parameters.
AWS CodePipeline supports namespaces and variables to share execution-state data between different actions. By setting a namespace (like 'SourceVariables') on an action, any of its output variables, such as 'CommitId', can be referenced in downstream action configurations using the syntax '#{Namespace.VariableName}'. Therefore, configuring the Deploy action with '#{SourceVariables.CommitId}' is the correct method.

Step-by-Step Solution

1
Identify the requirement to pass runtime metadata (Commit ID) from an upstream Source stage to a downstream Deploy stage.
The developer needs to utilize AWS CodePipeline's native variable sharing capability.
Native variables are the most efficient way to share dynamic data between pipeline actions without external dependencies.
2
Locate the namespace configured on the upstream action.
The source action namespace is defined as 'SourceVariables'.
Variables are grouped under a namespace to avoid collision and to reference them uniquely.
3
Reference the variable in the downstream action configuration using the syntax: `#{Namespace.VariableName}`.
The dynamic reference is formatted as `#{SourceVariables.CommitId}`.
This is the syntax recognized by CodePipeline to resolve variables at runtime.

Key Concept

AWS CodePipeline Action Variables and Namespaces
Question 36Question →

A developer is configuring a continuous integration and continuous delivery (CI/CD) pipeline in AWS CodePipeline. The pipeline includes a test stage that invokes an AWS Lambda function to run integration tests against a database. The Lambda function requires database credentials to connect to the database and must notify CodePipeline of the success or failure of the tests. Which of the following actions should the developer perform to configure this setup securely and correctly? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and grant the Lambda function's IAM execution role permission to retrieve the secret.; Grant the Lambda function's IAM execution role permission to perform the codepipeline:PutJobSuccessResult and codepipeline:PutJobFailureResult API operations.

Answer

To configure this setup securely and correctly, the developer should store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret. Additionally, the Lambda execution role must be granted permissions to call the codepipeline:PutJobSuccessResult and codepipeline:PutJobFailureResult API operations to report the job status back to CodePipeline.
Storing database credentials in AWS Secrets Manager allows secure storage and automatic rotation of secrets. The Lambda execution role must be granted permissions to retrieve this secret to connect to the database. Additionally, when CodePipeline invokes a Lambda function, the function runs asynchronously and must report the outcome back to CodePipeline. The Lambda function's execution role requires permission to call codepipeline:PutJobSuccessResult and codepipeline:PutJobFailureResult to update the pipeline stage status.

Step-by-Step Solution

1
Determine the secure method for storing and retrieving database credentials.
Identify AWS Secrets Manager as the appropriate service because it supports built-in rotation and secure runtime retrieval, unlike Systems Manager Parameter Store standard parameters.
This prevents credentials from being hardcoded in code or configuration files, adhering to security best practices.
2
Determine the required permissions for CodePipeline integration with Lambda.
Identify that the Lambda function must report its execution status back to CodePipeline to mark the stage as success or failure using the PutJobSuccessResult or PutJobFailureResult API operations.
Lambda tasks in CodePipeline run asynchronously. CodePipeline expects the function to send a success or failure token to complete the job; otherwise, the pipeline stage will remain in progress until it times out.

Key Concept

When AWS CodePipeline invokes an AWS Lambda function, the Lambda function must report back success or failure using the PutJobSuccessResult or PutJobFailureResult API calls. Additionally, database credentials should be stored securely in AWS Secrets Manager rather than in Parameter Store (which lacks native rotation for standard parameters) or hardcoded.
Question 37Question →

A developer is configuring a cross-account continuous delivery pipeline in AWS CodePipeline. The pipeline resides in Account A and must deploy an application to Account B. The pipeline uses an Amazon S3 bucket in Account A to store deployable artifacts, which must be encrypted using a customer managed key in AWS KMS. Arrange the steps in the correct sequence to configure the cross-account pipeline and its security components so that the deploy action in Account B can successfully access and decrypt the artifacts.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps to configure the cross-account pipeline is: first, create the customer managed KMS key in Account A; second, create the IAM deployment role in Account B; third, update the S3 artifact bucket policy in Account A to grant access to the Account B role; and finally, update the pipeline JSON definition in Account A to reference these resources.
The correct sequence begins with creating the KMS key in Account A to establish cross-account encryption permissions. Next, the IAM deployment role must be created in Account B so that its ARN exists. With the role created, the S3 bucket policy in Account A can then be updated to reference the role's ARN without causing validation errors. Finally, the pipeline definition is updated to tie the KMS key and the deployment role ARN into the pipeline configuration.

Step-by-Step Solution

1
Create the customer managed KMS key in Account A.
A KMS key is generated, and its policy is updated to grant cross-account permissions to Account B.
This establishes the cryptographic foundation required for securing cross-account artifact sharing, allowing Account B to decrypt pipeline artifacts.
2
Create the IAM deployment role in Account B.
An IAM role is created with a trust policy allowing the Account A pipeline execution role to assume it.
This role is required to perform the deployment in Account B and must be created first so its ARN exists for references in other policies.
3
Update the S3 artifact bucket policy in Account A.
The S3 bucket policy is modified to allow the Account B deployment role access to the artifacts.
AWS S3 validates the existence of IAM principal ARNs when saving bucket policies. The role in Account B must already exist to prevent a validation error.
4
Update the pipeline JSON definition in Account A.
The pipeline is updated with the KMS key associated with the artifact store and the deployment role ARN specified in the deploy action.
This binds the cross-account deployment configuration together, allowing CodePipeline to assume the Account B role during the deployment stage.

Key Concept

Cross-account AWS CodePipeline deployments require a specific ordering of resource creation because IAM role ARNs are validated during the saving of resource-based policies (like S3 bucket policies), and customer managed KMS keys are required for cross-account artifact encryption.
Question 38Question →

A developer is setting up a release pipeline in AWS CodePipeline that consists of a Source stage, a Build stage using AWS CodeBuild, and a Deploy stage. The developer needs to pass the build output files from the Build stage to the Deploy stage. Which configuration must the developer specify in the pipeline definition to transfer these files?

Show answer & explanation

Answer: Configure the build action to produce an output artifact, and configure the deploy action to accept that artifact as an input artifact.

Answer

Configure the build action to produce an output artifact, and configure the deploy action to accept that artifact as an input artifact.
In AWS CodePipeline, files are passed between stages using input and output artifacts. The developer defines an output artifact for the CodeBuild action and references it as an input artifact in the deployment action. CodePipeline automatically manages the storage of these files in an Amazon S3 artifact bucket associated with the pipeline.

Step-by-Step Solution

1
Identify the AWS CodePipeline mechanism for passing files between stages.
CodePipeline uses InputArtifacts and OutputArtifacts to move files between actions.
This is the native, secure, and automated way to manage flow of files in CodePipeline.
2
Assign the output artifact name in the Build stage.
The Build stage action produces an output artifact named (e.g.) BuildArtifact.
This registers the build output in CodePipeline's artifact store.
3
Reference the same artifact name as the input artifact in the Deploy stage.
The Deploy stage action consumes BuildArtifact as its input.
This tells CodePipeline to feed the build output files into the deployment step.

Key Concept

CodePipeline Artifacts
Estimated Time:1m 30s
Question 39Question →

An operations engineer is establishing a continuous deployment workflow for a critical microservice. The pipeline is designed to fetch code from a repository, package the application using AWS CodeBuild, create an AWS CloudFormation change set, require manual intervention for approval, and finally execute the change set.

In what chronological order do these events occur during a successful pipeline execution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The pipeline execution begins with the Source action detecting a commit and uploading the source ZIP file to S3. Next, the Build action downloads this source archive, runs the buildspec, and uploads the compiled package back to S3. Following the build, the first deployment action uses AWS CloudFormation to create a change set. The pipeline then pauses at the Manual Approval action to await user consent. Once approved, the final deployment action executes the CloudFormation change set to update the infrastructure.
The correct chronological sequence starts with the source action retrieving the codebase, followed by CodeBuild compiling and packaging the app. Once packaged, CloudFormation creates a change set so that the proposed infrastructure changes are calculated. The pipeline then pauses at the manual approval stage for verification. Finally, after approval, CloudFormation executes the change set to deploy the resources.

Step-by-Step Solution

1
Trigger pipeline and output source artifact
The Source stage runs, fetching code from the repository and storing it in the Amazon S3 artifact bucket.
AWS CodePipeline requires a source action to pull the source code and produce an input artifact for subsequent stages.
2
Compile and package the application
AWS CodeBuild runs the build stage, compiling code and outputting a packaged application template artifact to S3.
The build stage consumes the source artifact and produces the deployment package required by the deployment actions.
3
Generate the infrastructure change proposal
AWS CloudFormation creates a change set showing what resources will be created, modified, or deleted.
Creating a change set allows developers to review the proposed modifications before they are applied to the live environment.
4
Pause pipeline for manual approval
The pipeline halts transition to the next action, publishes a notification to an SNS topic, and waits for an approval decision.
This manual approval action is configured between the change set creation and execution to enforce gates and human validation.
5
Apply the infrastructure changes
AWS CloudFormation executes the previously created change set, deploying the updates to the stack.
After the manual approval action is approved, the execution resumes and applies the change set.

Key Concept

AWS CodePipeline execution flow, artifact transition, and integration of CloudFormation change sets with manual approvals.
Question 40Question →

A developer is managing a continuous delivery pipeline in AWS CodePipeline that consists of Source, Build, Test, and Production stages. The developer needs to temporarily stop code changes from being deployed to the Production stage while allowing developers to continue committing code and verifying builds in the Test stage. Additionally, the developer must configure the system to send email alerts to the operations team whenever any stage in the pipeline fails. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable the inbound transition on the Production stage in AWS CodePipeline.; Create an Amazon EventBridge rule that filters for CodePipeline stage execution failures and targets an Amazon Simple Notification Service (Amazon SNS) topic subscribed to by the operations team.

Answer

Disable the inbound transition on the Production stage in AWS CodePipeline, and create an Amazon EventBridge rule that filters for CodePipeline stage execution failures and targets an Amazon Simple Notification Service (Amazon SNS) topic subscribed to by the operations team.
To satisfy the deployment restriction requirement, disabling the inbound transition on the Production stage ensures that new changes can propagate through Source, Build, and Test but will not enter Production. To satisfy the email alert requirement, creating an EventBridge rule that filters on failed stage executions and targets an SNS topic is the correct and standard integration pattern.

Step-by-Step Solution

1
Identify the stage transition control mechanism in AWS CodePipeline.
Disabling the transition into the Production stage stops new executions from entering the Production stage while keeping transitions between Source, Build, and Test active.
This satisfies the requirement to allow developers to continue committing code and running tests without deploying to production.
2
Identify the notification mechanism for pipeline failures.
An Amazon EventBridge rule is created to detect CodePipeline Stage Execution State Changes where the state is FAILED.
EventBridge can trigger an Amazon SNS topic to send emails to the operations team, which is the standard event-driven approach for CodePipeline notifications.

Key Concept

AWS CodePipeline stage transitions and EventBridge notifications integration
PreviousPage 2 / 3Next