DOP-C02 Question #140: Real Exam Question with Answer & Explanation

Question

A global company manages multiple AWS accounts by using AWS Control Tower. The company hosts internal applications and public applications. Each application team in the company has its own AWS account for application hosting. The accounts are consolidated in an organization in AWS Organizations. One of the AWS Control Tower member accounts serves as a centralized DevOps account with CI/CD pipelines that application teams use to deploy applications to their respective target AWS accounts. An IAM role for deployment exists in the centralized DevOps account. An application team is attempting to deploy its application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster in an application AWS account. An IAM role for deployment exists in the application AWS account. The deployment is through an AWS CodeBuild project that is set up in the centralized DevOps account. The CodeBuild project uses an IAM service role for CodeBuild. The deployment is failing with an Unauthorized error during attempts to connect to the cross-account EKS cluster from CodeBuild. Which solution will resolve this error?

Options

• AConfigure the application account's deployment IAM role to have a trust relationship with the
• BConfigure the centralized DevOps account's deployment IAM role to have a trust relationship with the
• CConfigure the centralized DevOps account's deployment IAM role to have a trust relationship with the
• DConfigure the application account's deployment IAM role to have a trust relationship with the AWS