DOP-C02 · Question #136
A company is building a new pipeline by using AWS CodePipeline and AWS CodeBuild in a build account. The pipeline consists of two stages. The first stage is a CodeBuild job to build and package an…
The correct answer is B. Create a customer managed KMS key. Configure the KMS key policy to allow the IAM roles used by E. In the development account and in the production account, create an IAM role for CodePipeline. You can view the key policy for an AWS managed key or a customer managed key, but you can only change the key policy for a customer managed key.
Question
A company is building a new pipeline by using AWS CodePipeline and AWS CodeBuild in a build account. The pipeline consists of two stages. The first stage is a CodeBuild job to build and package an AWS Lambda function. The second stage consists of deployment actions that operate on two different AWS accounts: a development environment account and a production environment account. The deployment stages use the AWS CloudFormation action that CodePipeline invokes to deploy the infrastructure that the Lambda function requires. A DevOps engineer creates the CodePipeline pipeline and configures the pipeline to encrypt build artifacts by using the AWS Key Management Service (AWS KMS) AWS managed key for Amazon S3 (the aws/s3 key). The artifacts are stored in an S3 bucket. When the pipeline runs, the CloudFormation actions fail with an access denied error. Which combination of actions must the DevOps engineer perform to resolve this error? (Choose two.)
Options
- ACreate an S3 bucket in each AWS account for the artifacts. Allow the pipeline to write to the S3
- BCreate a customer managed KMS key. Configure the KMS key policy to allow the IAM roles used by
- CCreate an AWS managed KMS key. Configure the KMS key policy to allow the development account
- DIn the development account and in the production account, create an IAM role for CodePipeline.
- EIn the development account and in the production account, create an IAM role for CodePipeline.
How the community answered
(33 responses)- A24% (8)
- B58% (19)
- C12% (4)
- D6% (2)
Explanation
You can view the key policy for an AWS managed key or a customer managed key, but you can only change the key policy for a customer managed key.
Topics
Community Discussion
No community discussion yet for this question.