Examkin

Soru

Zorluk: OrtaAWS CodePipeline

A developer is configuring a deployment pipeline in AWS CodePipeline to deploy a serverless application across two AWS accounts. The pipeline resides in Account A, and the application must be deployed to Account B using an AWS CloudFormation action in the deploy stage. The pipeline execution fails at the deploy stage with an access denied error when attempting to assume the deployment IAM role created in Account B.

How should the developer configure the IAM policies to successfully allow the pipeline in Account A to assume the deployment role in Account B?

  1. Configure the trust policy of the deployment role in Account B to allow the sts:AssumeRole action from the CodePipeline service role in Account A, and grant the CodePipeline service role in Account A permission to call sts:AssumeRole on the deployment role in Account B.Cevap
  2. B
    Attach an identity-based IAM policy to the CodePipeline service role in Account A that allows the sts:AssumeRole action on the deployment role in Account B, as cross-account permissions do not require trust policies when initiated from a managed pipeline service role.
  3. C
    Create an IAM user in Account B, generate long-lived access keys, and store them as a secure parameter in AWS Systems Manager Parameter Store with automatic rotation configured, then reference the parameter in the pipeline configuration.
  4. D
    Add an aws sts assume-role command to the buildspec.yml file in the source repository to authenticate as Account B, and configure the CloudFormation deployment action to execute using the resulting temporary credentials.

Cevap

Configure the trust policy of the deployment role in Account B to allow the sts:AssumeRole action from the CodePipeline service role in Account A, and grant the CodePipeline service role in Account A permission to call sts:AssumeRole on the deployment role in Account B.
The correct option correctly establishes two-way trust for cross-account role assumption. The trust policy of the target role in Account B must trust the CodePipeline service role in Account A, and the CodePipeline service role must have an identity-based policy allowing it to assume the target role in Account B.

Adım Adım Çözüm

1
Configure the trust policy in the target account (Account B)
The deployment IAM role in Account B is updated to list the AWS CodePipeline service role ARN from Account A as a trusted principal that can perform sts:AssumeRole.
Establishing trust in the target account's role is mandatory for any cross-account access to succeed.
2
Configure the permissions policy in the source account (Account A)
An identity-based policy is attached to the CodePipeline service role in Account A allowing the sts:AssumeRole action on Account B's deployment role ARN.
The source principal must have explicit permission to assume the external role.
3
Reference the target role in the pipeline configuration
The pipeline deploy stage action configuration is updated with the roleArn parameter pointing to the target deployment role in Account B.
This instructs CodePipeline to assume the cross-account role when executing the CloudFormation action.

Anahtar Kavram

Cross-account role assumption in AWS CodePipeline
Bu soruyu puanla

Konular

AWS CodePipeline

Bu konudan daha fazla soru