DOP-C02 · Question #397
A company has an AWS account named PipelineAccount. The account manages a pipeline in AWS CodePipeline. The account uses an IAM role named CodePipeline_Service_Role and produces an artifact that is…
The correct answer is A. Update the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket. S3 bucket policy: Grant the CodeDeployAccount principal (or the DevOps_Role within that account) permission to read the pipeline’s artifact objects. DevOps_Role trust policy: Allow the PipelineAccount (specifically the CodePipeline_Service_Role) to assume the DevOps_Role in…
Question
A company has an AWS account named PipelineAccount. The account manages a pipeline in AWS CodePipeline. The account uses an IAM role named CodePipeline_Service_Role and produces an artifact that is stored in an Amazon S3 bucket. The company uses a customer managed AWS KMS key to encrypt objects in the S3 bucket. A DevOps engineer wants to configure the pipeline to use an AWS CodeDeploy application in an AWS account named CodeDeployAccount to deploy the produced artifact. The DevOps engineer updates the KMS key policy to grant the CodeDeployAccount account permission to use the key. The DevOps engineer configures an IAM role named DevOps_Role in the CodeDeployAccount account that has access to the CodeDeploy resources that the pipeline requires. The DevOps engineer updates an Amazon EC2 instance role that operates within the CodeDeployAccount account to allow access to the S3 bucket and the KMS key that is in the PipelineAccount account. Which additional steps will meet these requirements?
Options
- AUpdate the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket.
- BUpdate the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket.
- CUpdate the S3 bucket policy to grant the PipelineAccount account access to the S3 bucket.
- DUpdate the S3 bucket policy to grant the CodeDeployAccount account access to the S3 bucket.
How the community answered
(62 responses)- A82% (51)
- B5% (3)
- C2% (1)
- D11% (7)
Explanation
S3 bucket policy: Grant the CodeDeployAccount principal (or the DevOps_Role within that account) permission to read the pipeline’s artifact objects. DevOps_Role trust policy: Allow the PipelineAccount (specifically the CodePipeline_Service_Role) to assume the DevOps_Role in CodeDeployAccount. CodePipeline_Service_Role permissions: Add an sts:AssumeRole statement so it can switch into the DevOps_Role when executing the cross-account CodeDeploy action.
Topics
Community Discussion
No community discussion yet for this question.