Examkin

Soru

Zorluk: OrtaAWS CodePipeline

An organization has a deployment pipeline configured in AWS CodePipeline in Account A. The pipeline needs to deploy a containerized application to Amazon ECS in Account B. The developer creates a cross-account deployment IAM role in Account B. Which configuration must be implemented to allow the pipeline in Account A to assume this role and perform the deployment?

  1. A
    Attach an IAM permissions policy to the role in Account B that grants the sts:AssumeRole action to the CodePipeline service role in Account A, while keeping the trust policy of the role restricted to local services in Account B.
  2. B
    Store the AWS access keys of an IAM user from Account B as a SecureString parameter in AWS Systems Manager Parameter Store in Account A, and configure CodePipeline to retrieve these credentials at runtime.
  3. Configure the trust policy of the IAM role in Account B to allow the CodePipeline service role in Account A to perform the sts:AssumeRole action, and configure the deployment action in Account A to use this role ARN.Cevap
  4. D
    Configure the Amazon ECS Task Execution Role in Account B to trust the CodePipeline service role in Account A, enabling the container agent to pull the deployment artifacts directly.

Cevap

Configure the trust policy of the IAM role in Account B to allow the CodePipeline service role in Account A to perform the sts:AssumeRole action, and configure the deployment action in Account A to use this role ARN.
For cross-account deployments, the deployment action in Account A's pipeline must assume an IAM role in Account B. This is achieved by adding a trust policy to the role in Account B that allows the pipeline's service role in Account A to perform the sts:AssumeRole action. The deployment action in the pipeline is then configured to use the ARN of the role in Account B.

Adım Adım Çözüm

1
Identify the mechanism AWS CodePipeline uses to interact with resources in a different AWS account.
Cross-account access in AWS requires role assumption (sts:AssumeRole) rather than static credentials.
Using IAM roles avoids the security risks associated with managing static access keys.
2
Determine where to configure the trust relationship and how the role is assumed.
The trust policy must be configured on the target role in Account B to trust the pipeline's role in Account A.
Trust policies specify which external entities are allowed to assume the role.
3
Specify the role in the pipeline action configuration.
The deployment action in Account A's pipeline is updated to reference the target role's ARN in Account B.
This tells CodePipeline which role to assume when executing that specific action.

Anahtar Kavram

AWS CodePipeline cross-account resource deployment using IAM roles and trust policies.
Bu soruyu puanla

Konular

AWS CodePipeline

Bu konudan daha fazla soru