A regional bank keeps its CI/CD tooling in a shared-services account. Its payments API is deployed by an AWS CodePipeline pipeline into a separate production account, and the pipeline's artifact bucket is encrypted with a KMS key.
The first cross-account run failed at the deploy stage, because the production account's deployment role could not decrypt the input artifact. The bank's security policy forbids giving other accounts access to any key that the company does not control.
Each cross-account action must run under a role in the production account that holds only the permissions the deployment needs, and the artifact encryption must keep working across accounts.
Which change meets these requirements?
Choose one answer.
AA. Change the artifact bucket to use the AWS managed key for S3, and grant the production account's deployment role s3:GetObject on the bucket, so that the deploy stage can read the artifacts.
BB. Give the production account's deployment role kms:Decrypt on the shared-services account's AWS managed key for S3, and add that role to the key policy so that the deploy stage can read the artifacts.
CC. Replace the default artifact encryption with a customer managed KMS key whose key policy lets the production account use it, and grant the production deployment role kms:Decrypt on that key.
DD. Store the artifacts unencrypted in a separate bucket that the production account can read, and enable default SSE-S3 encryption on that bucket once the deploy stage has completed.
C. Right: Correct. Cross-account pipelines need a customer managed key whose key policy trusts the other account, and the role in that account also needs decrypt permission. The deploy stage then reads artifacts with a role limited to what it needs. Learn more: Allowing users in other accounts to use a KMS key (opens in a new tab)
A cross-account pipeline's artifacts are encrypted with a key that both accounts must use. AWS managed keys cannot be shared with another account, so the bank needs a customer managed key whose key policy and the production role's permissions both allow decryption. Unencrypted storage and edits to an AWS managed key do not meet the bank's requirements.
Want more on Multi-account pipelines and deployments? The 5 full-length practice sets have 9 more Multi-account pipelines and deployments questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →