Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A video streaming service uses the AWS CDK in a central tooling account to deploy an application stack into a separate production account. The CDK app synthesizes the template, and the team deploys it with cdk deploy from a pipeline.
The first deployment to production failed when the CDK CLI could not publish the template assets, because the production account had never been prepared for CDK deployments from the tooling account.
The security team requires that deployments to production use roles that exist in the production account, and that the tooling account's pipeline role get no broader access there than the CDK deployment needs.
Which action should the platform team take?
Choose one answer.
AA. Create an IAM user with administrator access in the production account, store its access keys in the pipeline, and let cdk deploy use those keys directly for every run.
BB. Copy the CDK app into a new SAM template, because SAM deploys without asset publishing, and deploy the resulting template with the pipeline's existing permissions.
CC. Run cdk synth in the production account and deploy its output with the pipeline, so that the CDK CLI never has to publish assets from the tooling account.
DD. Run cdk bootstrap in the production account with --trust set to the tooling account, so the bootstrap roles and asset bucket trust only that account.
Show the answer and explanation
Answer: D
A. Wrong: Administrator keys stored in a pipeline break the requirement to limit access, and they do not solve the asset publishing step. They also remain valid until someone rotates them by hand.
C. Wrong: Synthesis output still needs the asset files uploaded and the roles that deployment uses, so this does not remove the preparation step. It also moves the build into an account the security team does not want to change. Learn more: What is the AWS CDK? (opens in a new tab)
D. Right: Correct. Bootstrapping creates the deployment roles, file and image asset resources, and a CloudFormation execution role in the target environment. The trust setting limits those roles to the tooling account's pipeline. Learn more: AWS CDK bootstrapping (opens in a new tab)
Explanation
CDK deployments into another account need the target account bootstrapped, which creates the asset buckets and deployment roles there. Trusting the tooling account in that bootstrap keeps the roles inside the production account and limits what the pipeline can assume. Administrator keys, rewritten templates and synthesizing in the target account each break a stated requirement.
Want more on AWS CDK and AWS SAM? The 5 full-length practice sets have 8 more AWS CDK and AWS SAM questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →