DOP-C02 · Question #277
A company has an organization in AWS Organizations for its multi-account environment. A DevOps engineer is developing an AWS CodeArtifact based strategy for application package management across the…
The correct answer is B. Create a domain in the shared services account. Grant the organization read access and C. Create a repository in each application team's account. Grant each application team's account full D. Create a repository in the shared services account. Grant the organization read access to the. Explanation Using a single domain in the shared services account (B) provides centralized governance with the least administrative overhead, while individual repositories per application team (C) give each team full autonomy over their own packages. A shared repository in the…
Question
A company has an organization in AWS Organizations for its multi-account environment. A DevOps engineer is developing an AWS CodeArtifact based strategy for application package management across the organization. Each application team at the company has its own account in the organization. Each application team also has limited access to a centralized shared services account. Each application team needs full access to download, publish, and grant access to its own packages. Some common library packages that the application teams use must also be shared with the entire organization. Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose three.)
Options
- ACreate a domain in each application team's account. Grant each application team's account full
- BCreate a domain in the shared services account. Grant the organization read access and
- CCreate a repository in each application team's account. Grant each application team's account full
- DCreate a repository in the shared services account. Grant the organization read access to the
- EFor teams that require shared packages, create resource-based policies that allow read access to
- FSet the other application teams' repositories as upstream repositories.
How the community answered
(40 responses)- A25% (10)
- B57% (23)
- E10% (4)
- F8% (3)
Explanation
Explanation
Using a single domain in the shared services account (B) provides centralized governance with the least administrative overhead, while individual repositories per application team (C) give each team full autonomy over their own packages. A shared repository in the shared services account (D) allows common library packages to be distributed organization-wide through read access grants, completing the architecture with minimal management effort.
Why the distractors are wrong:
- Option A (domain per team account) creates unnecessary fragmentation - domains are meant to group repositories under unified governance, so scattering them defeats the purpose and increases overhead.
- Option E (resource-based policies per team for shared packages) requires manual policy creation for every sharing relationship, which is high-overhead compared to granting org-level read access once.
- Option F (upstream repositories between teams) adds complexity by chaining repositories together, which is unnecessary when a centralized shared repository already serves the organization.
Memory Tip: Think "One Domain, Many Repos" - in CodeArtifact, the domain is your org-level container (centralize it), while repositories are team-level workspaces (distribute them). Org-wide sharing belongs in the shared services account, not scattered across individual accounts.
Topics
Community Discussion
No community discussion yet for this question.