Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

A DevOps engineer is configuring a multi-account CI/CD pipeline using AWS Organizations. The pipeline is hosted in a Shared Services account and uses AWS CodePipeline to deploy resources into a Production account using AWS CloudFormation. The pipeline stores its build artifacts in an Amazon S3 bucket in the Shared Services account. The S3 bucket is encrypted using the default AWS-managed KMS key (aws/s3). During the deployment stage, the CloudFormation execution role in the Production account attempts to retrieve the build artifacts but fails with an Access Denied error. Which of the following actions will resolve this deployment failure?

  1. Configure the S3 bucket in the Shared Services account to use a Customer Managed Key (CMK) instead of the default AWS-managed key, and update the key policy to allow the IAM role in the Production account to decrypt the artifacts.Answer
  2. B
    Modify the key policy of the default AWS-managed key (aws/s3) in the Shared Services account to grant kms:Decrypt permissions to the CloudFormation execution role in the Production account.
  3. C
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing both accounts that grants kms:Decrypt permissions to the Production account's CloudFormation role.
  4. D
    Configure AWS CloudFormation drift detection in the Production account to automatically detect the encryption mismatch and update the S3 bucket's access permissions.

Answer

Configure the S3 bucket in the Shared Services account to use a Customer Managed Key (CMK) instead of the default AWS-managed key, and update the key policy to allow the IAM role in the Production account to decrypt the artifacts.
To resolve the Access Denied issue in a cross-account deployment pipeline, the S3 bucket containing the artifacts must be encrypted with a Customer Managed Key (CMK). The key policy of the CMK must then be configured to allow the external Production account's IAM role to perform the kms:Decrypt action. AWS-managed keys cannot be shared cross-account.

Step-by-Step Solution

1
Identify the root cause of the cross-account decryption failure.
The default AWS-managed key aws/s3 cannot be used across different AWS accounts because its key policy is non-modifiable.
AWS-managed keys only allow access from within the same AWS account.
2
Create and configure a Customer Managed Key (CMK) in the Shared Services account.
A new KMS key is created with a customizable key policy.
A CMK allows explicit cross-account access to be defined in its key policy.
3
Update the key policy of the CMK and configure S3 encryption.
The Production account's IAM role is granted kms:Decrypt access, and the S3 bucket is updated to use the new CMK.
This enables the cross-account deployment pipeline to securely retrieve and decrypt deployment artifacts.

Key Concept

Cross-account AWS KMS key sharing with Customer Managed Keys in CI/CD pipelines
Estimated Time:2m 0s
Rate this question

Topics

Automating Deployment and Configuration Management