Examkin

Soru

Zorluk: OrtaAWS CodePipeline

A developer is configuring a continuous delivery pipeline using AWS CodePipeline in Account A. The pipeline needs to deploy a serverless application to Account B using AWS CloudFormation. The developer has created a deployment IAM role in Account B with the required permissions to create and manage the application resources. However, when the pipeline runs, the CloudFormation deployment stage fails with an Access Denied error. Which of the following configurations will resolve this issue?

  1. Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role in Account A to assume it, and configure the CloudFormation action in Account A's pipeline to use this cross-account role.Cevap
  2. B
    Add the permissions policy from the deployment IAM role in Account B directly to the CodePipeline service role in Account A, and configure the CloudFormation action to run without specifying a role.
  3. C
    Generate long-lived access keys for an IAM user in Account B, store them as a SecureString parameter in Systems Manager Parameter Store in Account A, and configure the CloudFormation action to retrieve these keys for authentication.
  4. D
    Manually deploy the CloudFormation stack in Account B's console first to establish resource ownership, and configure the pipeline in Account A to update the existing stack directly.

Cevap

Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role in Account A to assume it, and configure the CloudFormation action in Account A's pipeline to use this cross-account role.
The correct option correctly configures cross-account authorization. AWS CodePipeline supports executing actions in another account by assuming a role created in that account. The role in the target account must trust the CodePipeline service role to perform the 'sts:AssumeRole' action, and the pipeline action configuration must specify the target role ARN.

Adım Adım Çözüm

1
Modify the trust policy of the IAM role in Account B (target account) to add a trust relationship allowing the 'sts:AssumeRole' action for the CodePipeline service role ARN from Account A.
The IAM role in the target account is now allowed to be assumed by the CodePipeline service role in the source account.
This establishes cross-account trust required for secure delegation of authority.
2
Update the CodePipeline action configuration in the deployment stage in Account A to reference the IAM role ARN from Account B under the 'RoleArn' parameter.
CodePipeline is configured to assume the target account role when executing the CloudFormation action.
This instructs CodePipeline to use the trusted target account role's temporary credentials for deployment.

Anahtar Kavram

Cross-account deployments in AWS CodePipeline require configuring IAM trust policies that allow the pipeline service role to assume a target deployment role in the destination account.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS CodePipeline

Bu konudan daha fazla soru