An enterprise uses AWS CodePipeline in a centralized DevOps account () to build and deploy a microservices application to an Amazon ECS cluster running in a target production account (). The pipeline stores its build artifacts in an Amazon S3 bucket in the DevOps account. The S3 bucket is encrypted.
During a deployment run, the pipeline fails at the Deploy stage with the following error:
`KMS.NotFoundException: The KMS key with ID arn:aws:kms:us-east-1:111111111111:key/... does not exist or is not authorized.`
A Solutions Architect needs to resolve the deployment failure while adhering to the principle of least privilege.
Which combination of configuration steps will resolve the deployment failure? (Select TWO.)
- Grant the IAM role used by CodeDeploy in the target account permissions for `kms:Decrypt` and `kms:GenerateDataKey` on the DevOps account's customer managed key (CMK). Update the KMS CMK policy in the DevOps account to allow the target account's deployment IAM role to perform `kms:Decrypt` and `kms:GenerateDataKey` actions.Cevap
- Configure the Amazon S3 artifact bucket in the DevOps account to use a customer managed key (CMK) instead of the default AWS managed key (`aws/s3`). Update the S3 bucket policy in the DevOps account to allow the IAM role used by CodeDeploy in the target account to perform `s3:GetObject` and `s3:PutObject` actions.Cevap
- CConfigure the Amazon S3 artifact bucket in the DevOps account to use the default AWS managed KMS key (`aws/s3`). Update the IAM policy of the target account's deployment role to allow cross-account usage of the `aws/s3` key in the DevOps account.
- DCreate a Service Control Policy (SCP) at the Organization root that explicitly allows cross-account actions on the DevOps account's KMS key and S3 bucket, and attach the SCP to the Organizational Unit (OU) containing both accounts.
- EManually update the ECS Task Definition in the target production account with the new container image URI and configure AWS Systems Manager State Manager to detect this drift and automatically synchronize the deployment metadata back to the DevOps account's S3 bucket.
Cevap
Configure the S3 artifact bucket to use a customer managed key (CMK) instead of the default AWS managed key, update the S3 bucket policy to allow access to the target deployment role, and update both the KMS CMK policy and the target IAM role to allow key decryption and data key generation.
To fix cross-account deployment errors in CodePipeline, the target deployment role must have permissions to decrypt artifacts stored in the DevOps account's S3 bucket. Because AWS-managed keys cannot be shared across accounts, the S3 bucket must be encrypted using a Customer Managed Key (CMK). Permissions must be enabled on both sides: the source account's KMS key policy and S3 bucket policy must trust the target account's deployment role, and the target account's deployment role policy must allow KMS decryption and S3 retrieval.
Adım Adım Çözüm
Anahtar Kavram
Cross-Account KMS and S3 permissions for CodePipeline deployments