Examkin

Soru

Zorluk: OrtaAutomating Deployment and Configuration Management

A company is building a continuous integration and continuous delivery (CI/CD) pipeline using AWS CodePipeline in a centralized DevTools AWS account. The pipeline needs to deploy application stacks to multiple production member accounts within the same AWS Organization by using AWS CloudFormation. The deployment artifacts are stored in an Amazon S3 bucket in the DevTools account. The company's security policy requires that all data stored in the S3 bucket be encrypted at rest and that access follow the principle of least privilege. During execution, the pipeline fails because the deployment roles in the target production accounts cannot access the artifacts in the S3 bucket. Which combination of actions will allow the pipeline to successfully deploy the application stacks to the production accounts? (Select two.)

  1. Configure the Amazon S3 artifact bucket in the DevTools account to use an AWS KMS customer managed key, and update the key policy to allow the cross-account IAM roles in the production accounts to perform decryption operations.Cevap
  2. B
    Configure the Amazon S3 artifact bucket in the DevTools account to use the default AWS managed key (aws/s3), and attach a policy to the production execution roles allowing cross-account access to the default key.
  3. Configure the pipeline's deployment stage to assume a cross-account IAM role in the target production accounts, and update the S3 bucket policy in the DevTools account to grant these roles permission to read the artifacts.Cevap
  4. D
    Apply a Service Control Policy (SCP) to the production Organizational Unit (OU) that explicitly delegates access to the DevTools account's CodePipeline service role, allowing it to bypass local IAM policies in the production accounts.
  5. E
    Manually update the configuration of the deployed resources in the production accounts using the AWS Console to point to the central S3 bucket, then configure CloudFormation drift detection to prevent future stack updates from rolling back due to manual changes.

Cevap

Configure the Amazon S3 artifact bucket in the DevTools account to use an AWS KMS customer managed key with a key policy allowing cross-account decryption, and configure the pipeline's deployment stage to assume a cross-account IAM role in the production accounts while granting it read access in the S3 bucket policy.
For cross-account deployments, the pipeline must assume an IAM role in the destination account. Since the S3 bucket contains build artifacts, that destination role must be granted permissions to read from the bucket via the bucket policy in the DevTools account. Additionally, because the artifacts are encrypted, a customer managed key (CMK) must be used since default AWS managed keys cannot be shared across accounts. The key policy on the CMK must allow the target role in the production account to decrypt the objects.

Adım Adım Çözüm

1
Configure the S3 bucket to use an AWS KMS customer managed key (CMK).
Deployment artifacts will be encrypted with a key that supports sharing across AWS accounts.
AWS-managed KMS keys do not allow cross-account access.
2
Update the S3 bucket policy and KMS key policy in the DevTools account.
The target production account roles are allowed to get objects and decrypt them.
Explicit cross-account permissions must be granted on both the storage resource and the key resource.
3
Configure the CodePipeline deployment action to assume the target production account IAM role.
The deployment is executed in the context of the destination account with proper localized permissions.
CloudFormation needs local execution capabilities inside the production account to deploy resources.

Anahtar Kavram

Cross-account pipeline automation and secure artifact sharing using Customer Managed KMS Keys and S3 bucket policies.
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management