Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

A retail company manages its multi-account environment using AWS Organizations. The central DevOps account hosts a CI/CD pipeline using AWS CodePipeline to package applications and store the deployment artifacts in a central Amazon S3 bucket. The artifacts are encrypted using the default AWS-managed KMS key (aws/s3). An AWS CodeDeploy deployment group in a target production account retrieves these artifacts to update an Application Load Balancer-backed Auto Scaling group (ASG) of Amazon EC2 instances. Recently, deployments have been failing because target production accounts cannot decrypt and retrieve the deployment artifacts. Additionally, local engineers have manually modified target ASG configurations (such as desired capacity and launch templates), causing configuration drift from the source AWS CloudFormation templates. The company wants to automatically detect and remediate this drift while restoring the deployment pipeline functionality. Which combination of steps should a solutions architect implement to resolve the deployment failure and automate drift remediation?

  1. Configure the S3 bucket in the central DevOps account to use an AWS KMS Customer Managed Key (CMK). Update the CMK policy to grant the target production account's IAM execution role kms:Decrypt and kms:GenerateDataKey permissions, and grant read access via the S3 bucket policy. In the target account, use an AWS Config rule to monitor CloudFormation stack drift and configure an AWS Systems Manager Automation remediation action using the AWS-UpdateCloudFormationStack document to synchronize the resources with the template.Answer
  2. B
    Retain the default AWS-managed KMS key (aws/s3) encryption on the central S3 bucket. Create and attach a Service Control Policy (SCP) at the root of the AWS Organization that grants the target production account's IAM execution role permission to perform kms:Decrypt on the default key and read the S3 bucket. In the target account, configure an AWS Config rule to detect drift and trigger an AWS Systems Manager State Manager association to directly run CLI scripts that reconfigure the ASG parameters.
  3. C
    Configure the S3 bucket in the central DevOps account to use an AWS KMS Customer Managed Key (CMK). Update the CMK policy to grant the target production account's IAM execution role kms:Decrypt and kms:GenerateDataKey permissions. In the target account, configure an AWS Config rule to monitor stack drift, and configure a remediation action that triggers an AWS Lambda function to directly modify the ASG's launch template and desired capacity using the AWS CLI to match the expected values.
  4. D
    Configure the S3 bucket in the central DevOps account to use an AWS KMS Customer Managed Key (CMK). Update the CMK policy to grant the target production account's IAM execution role kms:Decrypt and kms:GenerateDataKey permissions. In the target account, configure a CodeDeploy lifecycle hook to monitor ASG configuration compliance during deployments. If any configuration drift is detected, configure CodeDeploy to automatically trigger a linear rollback of the deployment without updating the underlying CloudFormation stack.

Answer

Configure the S3 bucket in the central DevOps account to use an AWS KMS Customer Managed Key (CMK) with appropriate cross-account permissions, and use AWS Config to trigger AWS Systems Manager Automation executing the AWS-UpdateCloudFormationStack document to resolve configuration drift.
The correct option addresses the cross-account decryption issue by replacing the AWS-managed KMS key with a Customer Managed Key (CMK) and updating the key policy to permit cross-account IAM access. It also handles drift remediation properly by using AWS Config to trigger Systems Manager Automation, which executes a CloudFormation stack update to align the actual resources with the template definition without bypassing CloudFormation control.

Step-by-Step Solution

1
Configure the S3 bucket in the central DevOps account to use an AWS KMS Customer Managed Key (CMK) instead of the default AWS-managed KMS key.
The S3 bucket uses a key whose policy can be modified to grant cross-account permissions.
AWS-managed keys (such as aws/s3) do not support policy modification and cannot be shared across AWS accounts.
2
Update the Customer Managed Key policy to grant target production account IAM roles kms:Decrypt and kms:GenerateDataKey permissions, and allow read access in the S3 bucket policy.
The target production account's IAM execution role can download and decrypt the deployment artifacts from S3.
Cross-account access to encrypted S3 resources requires both S3 bucket policy allowance and explicit KMS key policy permissions.
3
Deploy the cloudformation-stack-drift-detection-check AWS Config rule in the target account and configure Systems Manager Automation to execute AWS-UpdateCloudFormationStack when drift is detected.
Resource configuration drift is automatically detected and remediated by updating the CloudFormation stack to match the template.
Direct, out-of-band modifications to managed resources break the CloudFormation stack state. Remediation must go through the CloudFormation API to keep the stack in a consistent state.

Key Concept

Cross-account pipeline artifact sharing requires AWS KMS Customer Managed Keys (CMKs) to enable cross-account policies, and infrastructure configuration drift must be remediated through the deployment framework (AWS CloudFormation) rather than out-of-band API calls to maintain stack consistency.
Estimated Time:3m 0s
Rate this question

Topics

Automating Deployment and Configuration Management