Examkin

Soru

Zorluk: ZorAWS CodePipeline

A developer is implementing a cross-account continuous delivery pipeline in AWS CodePipeline. The pipeline is located in Account A and uses an Amazon S3 bucket in Account A to store artifacts. The deployment stage is configured to deploy resources into Account B using an AWS CloudFormation action. During pipeline execution, the CloudFormation action in Account B fails with an Access Denied error when trying to retrieve the input artifact zip file from the S3 bucket in Account A. The IAM role used for the CloudFormation deployment in Account B has been granted read permission to the S3 bucket in Account A, and the S3 bucket policy in Account A permits access from Account B's deployment role.

Which configuration change is required to resolve this deployment failure?

  1. A
    Update the IAM trust policy of the CodePipeline service role in Account A to allow the deployment IAM role in Account B to assume it, and configure AWS Systems Manager Parameter Store in Account B to cache the S3 credentials.
  2. Configure the S3 bucket in Account A to use a customer managed AWS KMS key instead of the default S3 managed key, grant the deployment IAM role in Account B permission to use the KMS key, and update the KMS key policy in Account A to trust Account B's deployment role.Cevap
  3. C
    Store the S3 bucket access credentials as a secret in AWS Secrets Manager in Account A, and configure the deployment IAM role in Account B to retrieve the secret by making a call to AWS Systems Manager Parameter Store.
  4. D
    Configure the deployment IAM role in Account B to trust the CodePipeline service role in Account A by updating its trust policy, and configure the CodePipeline service role in Account A to assume the deployment IAM role in Account B without a KMS key.

Cevap

Configure the S3 bucket in Account A to use a customer managed AWS KMS key instead of the default S3 managed key, grant the deployment IAM role in Account B permission to use the KMS key, and update the KMS key policy in Account A to trust Account B's deployment role.
For cross-account deployments in AWS CodePipeline, artifacts stored in the Amazon S3 bucket must be encrypted using a customer managed AWS KMS key. The default S3 managed key (aws/s3) cannot be shared cross-account because its key policy cannot be modified to grant access to external IAM roles. By configuring a customer managed KMS key, the developer can explicitly grant the deployment IAM role in the destination account permission to decrypt the artifacts.

Adım Adım Çözüm

1
Determine why the access is denied despite correct IAM and bucket policies.
The default S3 encryption key (aws/s3) is managed by AWS and its policy cannot be modified to grant cross-account permissions.
Identify the root cause of cross-account decryption failures in CodePipeline.
2
Create a customer managed AWS KMS key in Account A to encrypt the S3 artifact bucket.
The S3 bucket's default encryption is updated to use the new customer managed key.
Allows custom key policies to be configured for cross-account access.
3
Update the KMS key policy in Account A and the IAM deployment role in Account B.
The deployment role in Account B can now decrypt the artifacts when CloudFormation runs in Account B.
Establishes secure, cross-account access to the build artifacts.

Anahtar Kavram

AWS CodePipeline Cross-Account Deployments and Artifact Encryption
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

AWS CodePipeline

Bu konudan daha fazla soru