CI/CD and multi-account pipelines: SAP-C03 study notes and practice questions
What to know about CI/CD and multi-account pipelines for the SAP-C03 exam, from the Operational Excellence and Automation domain (20% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 asks how to build and release across many accounts and Regions securely: who assumes which role, how artifacts are encrypted and shared, and how to promote the same build to production.
The building blocks
CodePipeline orchestrates stages and actions. Type V2 pipelines add Git triggers with branch, tag and file-path filters, pipeline variables, and execution modes (queued, superseded, parallel).
CodeBuild runs builds and tests in managed containers, optionally inside your VPC, and publishes test and coverage reports.
CodeDeploy deploys to EC2 and on-premises servers, Lambda and ECS with in-place, canary, linear or blue/green strategies. See deployment strategies.
Source: CodeCommit, S3, ECR, or GitHub, GitLab and Bitbucket through AWS CodeConnections.
Manual approval actions gate production; failing stages can roll back automatically in V2 pipelines.
Cross-account pipelines
The pipeline runs in a tooling account.
Each target account has a cross-account role whose trust policy names the pipeline’s service role (not the whole tooling account), with only the permissions the deployment needs. The action’s roleArn points to it.
CloudFormation deploy actions also pass a CloudFormation execution role in the target account that creates the resources.
The S3 artifact bucket’s bucket policy grants the target roles access.
Artifacts are encrypted with a customer managed KMS key whose key policy allows the target accounts. The default AWS managed key can’t be used across accounts, and cross-account configuration must reference the key ARN, not an alias.
Cross-Region pipelines
A cross-Region action needs an artifact store (bucket and key) in each Region where actions run; CodePipeline copies artifacts to it.
ECR replication copies images to other Regions and accounts, so each Region pulls locally.
StackSets or a CDK Pipelines wave can deploy to many Regions from one stage.
Artifact promotion
Build once, deploy many: promote the same image digest or package version through test, staging and production. Rebuilding per stage means production runs untested bits.
Store environment differences in parameters, not in separate builds.
Use immutable ECR tags and record which commit produced which artifact.
How to choose
Scenario wording
Choose
“Pipeline in a shared services account deploys to prod account”
Cross-account role assumed by the action, customer managed KMS key, bucket policy
“Developers must not have credentials in production”
Pipeline-only deployment role in prod; humans get read-only
“Deploy to three Regions from one pipeline”
Cross-Region actions with an artifact store per Region, or StackSets
“Production must run the exact image that passed tests”
Promote by image digest; no rebuild per stage
“Start the pipeline only when files under /infra change”
V2 pipeline trigger with file-path filter
Common traps
AWS managed KMS keys for cross-account artifacts.
Long-term access keys for target accounts stored in the pipeline or build environment.
Trusting the entire tooling account in the deployment role.
One artifact bucket for actions in several Regions.
A separate pipeline per account copied by hand, when one pipeline with stages per account, or StackSets, scales better.
A retailer deploys its checkout service with AWS CodePipeline from a tooling account. The pipeline must deploy to staging and production accounts in two Regions, and the build artifacts are encrypted with a customer managed KMS key.
The security team forbids the tooling account from holding administrator access to the target accounts, and production changes must wait for a named approver.
Which TWO pipeline designs meet these requirements? (Choose two.)
Choose two answers.
AA. Give the pipeline's service role administrator access in every target account, so that deployments never fail on missing permissions.
BB. Create a deployment role in each target account that trusts the pipeline's service role and can manage only the stacks it deploys, and grant those roles use of the artifact bucket and KMS key in each Region.
CC. Copy each build artifact into a bucket in every target account by hand after the build, and point each stage at its local copy of the artifact.
DD. Add a manual approval action before the production stage, notify the named approver through an SNS topic, and allow only the approver's IAM role to approve the action.
EE. Run the production deployment without an approval action, and rely on the staging stage's tests to show that the change is safe to release.
Show the answer and explanation
Answers: B, D
A. Wrong: Administrator access in every target account breaks the security team's rule for the tooling account. The design gives the pipeline far more rights than the deployment needs.
B. Right: Correct. Each deployment runs in the target account with a limited role that the pipeline assumes, and the bucket and key policies let those roles read and decrypt the artifacts in each Region. No target account grants the tooling account administrator access.
C. Wrong: Manual copies add steps that can be skipped or go out of date, and the design does not add the approval that production needs. The approach is not a dependable pipeline.
D. Right: Correct. A manual approval action holds the pipeline at the production stage until the approver acts, and IAM limits who can approve. The approval is recorded in the pipeline history.
E. Wrong: Staging tests do not replace the named approval the production change needs, and the option removes the control the requirement asks for.
Explanation
Assumed deployment roles in each target account limit the pipeline's rights, with key policies granting the artifact key to those accounts, and a manual approval action holds production for the named approver. Administrator access, manual artifact copies and an approval-free production stage each break a stated requirement.
Want more on CI/CD and multi-account pipelines? The 5 full-length practice sets have 10 more CI/CD and multi-account pipelines questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →