Examkin

Soru

Zorluk: OrtaAWS CodePipeline

An enterprise application utilizes a release pipeline in AWS CodePipeline to automate deployments. The pipeline has a source stage in a development AWS account and must deploy a containerized application to an Amazon ECS cluster located in a separate production AWS account. During execution, the Deploy stage fails when trying to invoke the deployment action in the production account, returning an access denied error when attempting to assume the target role.

Which configuration is necessary to successfully authorize this cross-account deployment?

  1. Modify the trust policy of the IAM role in the production account to allow the IAM role executing the pipeline in the development account to perform the sts:AssumeRole action.Cevap
  2. B
    Add a permissions policy statement to the target IAM role in the production account allowing the sts:AssumeRole action for the development pipeline's IAM role, without modifying its trust policy.
  3. C
    Create a secure string parameter in AWS Systems Manager Parameter Store containing the production account's credentials, enable automatic rotation, and inject them into the deployment stage.
  4. D
    Update the Amazon ECS Task Execution Role in the production account to grant the pipeline's service role direct permissions to deploy the container image.

Cevap

Modify the trust policy of the IAM role in the production account to allow the IAM role executing the pipeline in the development account to perform the sts:AssumeRole action.
For AWS CodePipeline to perform deployments in a separate AWS account, it must assume an IAM role inside that target account. For the role assumption to succeed, the trust policy (assume role policy) of the target IAM role must be configured to trust the pipeline's IAM role in the source account, granting it the sts:AssumeRole permission.

Adım Adım Çözüm

1
Identify the authentication failure context.
The failure occurs during a cross-account deployment stage when the source account's CodePipeline attempts to assume the target IAM role in the production account.
AWS CodePipeline requires cross-account role delegation using AWS Security Token Service (STS) to deploy across accounts.
2
Determine where the delegation of trust is configured.
The trust must be established on the target resource (the production IAM role) to allow assumption by the source entity.
An IAM role's trust policy dictates which external AWS accounts or IAM principals are permitted to assume it.
3
Modify the target role's trust policy.
Add the ARN of the development pipeline's IAM role (or the development account root) to the principal element of the production role's trust policy with the sts:AssumeRole action.
This establishes a secure cryptographic trust chain between the two AWS accounts.

Anahtar Kavram

Cross-Account Access in AWS CodePipeline via STS AssumeRole
Bu soruyu puanla

Konular

AWS CodePipeline

Bu konudan daha fazla soru