Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

A company uses a centralized tooling account to host AWS CodePipeline, which automates application infrastructure deployments across multiple target AWS accounts in an AWS Organization. The pipeline uses AWS CloudFormation to deploy resources, using templates stored in an Amazon S3 bucket in the tooling account. To secure database credentials, the CloudFormation template references secret values stored in AWS Secrets Manager in the tooling account.

During a deployment run, the pipeline fails. The pipeline execution logs indicate that the CloudFormation deployment role in the target accounts cannot retrieve the template artifacts from the S3 bucket, and cannot decrypt the database credentials stored in Secrets Manager.

Which two actions should the Solutions Architect take to resolve these deployment failures? (Select two.)

  1. Update the S3 bucket policy in the tooling account to allow the deployment IAM role in the target accounts to perform the s3:GetObject action.Answer
  2. Use a Customer Managed Key (CMK) to encrypt the Secrets Manager secrets in the tooling account, and configure its key policy to allow the deployment IAM role in the target accounts to perform the kms:Decrypt action.Answer
  3. C
    Share the default AWS-managed KMS key (aws/secretsmanager) in the tooling account with the target accounts by attaching a cross-account IAM policy to the target deployment roles.
  4. D
    Attach a Service Control Policy (SCP) to the target accounts' Organizational Unit (OU) that grants the deployment IAM roles permissions to read the S3 bucket in the tooling account.
  5. E
    Configure AWS Systems Manager State Manager to automatically perform manual API updates on the target account resources to resolve configuration errors and bypass the pipeline blocks.

Answer

To resolve the deployment failures, the S3 bucket policy in the tooling account must be updated to allow the deployment roles in the target accounts to retrieve templates. Additionally, the secrets must be encrypted with a Customer Managed Key (CMK) in the tooling account, and its key policy must grant decryption permissions to the target accounts' deployment roles.
The correct options involve resolving the cross-account access issues using native IAM and resource sharing mechanisms. First, the S3 bucket policy in the tooling account must explicitly allow the target accounts' deployment roles to perform s3:GetObject to fetch the deployment templates. Second, because default AWS-managed KMS keys cannot be shared cross-account, a Customer Managed Key (CMK) must be used to encrypt the database credentials, and its key policy must be updated to allow the target accounts' deployment roles to perform kms:Decrypt.

Step-by-Step Solution

1
Address the template retrieval failure.
The target accounts need read access to the S3 bucket in the tooling account. This requires updating the S3 bucket policy to allow cross-account access.
Since the S3 bucket is in a different account, a resource-based bucket policy must explicitly permit the IAM roles in the target accounts to perform s3:GetObject.
2
Address the secret decryption failure.
Create a Customer Managed Key (CMK) in the tooling account, encrypt the secrets with it, and update the key policy to allow kms:Decrypt for the target accounts' deployment roles.
AWS-managed KMS keys (like aws/secretsmanager) are restricted to their local account and cannot be shared cross-account. A Customer Managed Key is required to delegate access.
3
Verify that incorrect cross-account access and drift-inducing options are eliminated.
Eliminated options using SCPs for cross-account access, AWS-managed keys for cross-account decryption, or direct configuration modification.
SCPs cannot grant cross-account permissions, AWS-managed keys are non-sharable, and direct API changes lead to CloudFormation stack drift.

Key Concept

Cross-account resource sharing, secure configuration management, and deployment automation boundaries.
Rate this question

Topics

Automating Deployment and Configuration Management