A university runs its student-information system in three accounts: development, test and production. A central tooling account holds the AWS CodePipeline pipeline, and the team deploys CloudFormation stacks into each target account.
The current pipeline uses one service role that has administrator access in every target account, and the security office has rejected it. Each deployment should run under a role that exists only in the account it deploys to, carrying only the permissions that the stack needs.
The team also wants a single pipeline with one approval gate before production, and no copies of the pipeline definition for each account.
Which change meets these requirements?
Choose one answer.
AA. Create a deployment role in each target account that trusts the tooling account's pipeline role, and set the role ARN of each cross-account deploy action to the matching target account role.
BB. Give the tooling account's pipeline role the AdministratorAccess managed policy, and add that role to a trust list in each target account, so that one role can deploy everywhere with fewer roles to manage.
CC. Create three pipelines, one per account, each with its own copy of the template and its own approval gate, and run them in sequence with a Lambda function that starts the next pipeline.
DD. Attach a deployment policy to each target account as a service control policy, so that the tooling account's role gains deploy rights in that account without any role being created.
B. Wrong: Administrator access is the problem the security office rejected. A shared administrator role also lets any pipeline stage change any account.
C. Wrong: This separates the roles, but the team would maintain three definitions and a Lambda chain. The request was for a single pipeline with one approval gate.
D. Wrong: Service control policies restrict permissions and do not grant them, so they cannot give the pipeline access. Access still needs a role in the target account that trusts the tooling account. Learn more: Service control policies (SCPs) (opens in a new tab)
Explanation
A cross-account CodePipeline action assumes a role in the target account, so each account keeps its own deployment role. The role's trust policy names only the tooling account, and its permissions cover only what the stack needs. Shared administrator roles and copied pipelines break the security rule or add upkeep, and service control policies restrict access without granting any.
Want more on Multi-account pipelines and deployments? The 5 full-length practice sets have 9 more Multi-account pipelines and deployments questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →