SAP-C03 practice question: CI/CD and multi-account pipelines
Operational Excellence and Automation A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A retailer deploys its checkout service with AWS CodePipeline from a tooling account. The pipeline must deploy to staging and production accounts in two Regions, and the build artifacts are encrypted with a customer managed KMS key.
The security team forbids the tooling account from holding administrator access to the target accounts, and production changes must wait for a named approver.
Which TWO pipeline designs meet these requirements? (Choose two.)
Choose two answers.
AA. Give the pipeline's service role administrator access in every target account, so that deployments never fail on missing permissions.
BB. Create a deployment role in each target account that trusts the pipeline's service role and can manage only the stacks it deploys, and grant those roles use of the artifact bucket and KMS key in each Region.
CC. Copy each build artifact into a bucket in every target account by hand after the build, and point each stage at its local copy of the artifact.
DD. Add a manual approval action before the production stage, notify the named approver through an SNS topic, and allow only the approver's IAM role to approve the action.
EE. Run the production deployment without an approval action, and rely on the staging stage's tests to show that the change is safe to release.
Show the answer and explanation
Answers: B, D
A. Wrong: Administrator access in every target account breaks the security team's rule for the tooling account. The design gives the pipeline far more rights than the deployment needs.
B. Right: Correct. Each deployment runs in the target account with a limited role that the pipeline assumes, and the bucket and key policies let those roles read and decrypt the artifacts in each Region. No target account grants the tooling account administrator access.
C. Wrong: Manual copies add steps that can be skipped or go out of date, and the design does not add the approval that production needs. The approach is not a dependable pipeline.
D. Right: Correct. A manual approval action holds the pipeline at the production stage until the approver acts, and IAM limits who can approve. The approval is recorded in the pipeline history.
E. Wrong: Staging tests do not replace the named approval the production change needs, and the option removes the control the requirement asks for.
Explanation
Assumed deployment roles in each target account limit the pipeline's rights, with key policies granting the artifact key to those accounts, and a manual approval action holds production for the named approver. Administrator access, manual artifact copies and an approval-free production stage each break a stated requirement.
Want more on CI/CD and multi-account pipelines? The 5 full-length practice sets have 10 more CI/CD and multi-account pipelines questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →