DOP-C02 Question 17
Single answerYou are designing a CI/CD pipeline for an organization using AWS CodePipeline. The organization has separate AWS accounts for development, testing, and production environments. Each account has strict IAM policies requiring minimal cross-account access. Which deployment pattern should you use to ensure seamless pipeline execution across these accounts while adhering to the security policies?
- A
Create separate pipelines in each account and use manual approvals to transition artifacts between accounts.
- B
Use a single pipeline in the development account and assume IAM roles in the testing and production accounts via cross-account access.
- C
Set up a centralized pipeline in a management account and use AWS CodeDeploy to deploy to the development, testing, and production accounts.
- D
Use a single pipeline in the production account and share artifacts directly with the development and testing accounts.
Show answer and explanation
Correct answer: B
Explanation
The recommended approach for multi-account CI/CD pipelines is to use a single pipeline in one account (commonly the development account) and assume IAM roles in other accounts (testing, production) as needed. This pattern ensures minimal cross-account permissions, adheres to security best practices, and enables seamless execution. It leverages AWS Identity and Access Management (IAM) role assumption, which is a secure way to interact with resources in different accounts.
- A. Incorrect.
Creating separate pipelines in each account with manual approvals increases operational overhead and does not automate the process efficiently. It also introduces potential delays in the pipeline workflow.
- B. Correct.
Using a single pipeline in the development account and assuming IAM roles via cross-account access is a recommended approach. This minimizes the need for direct cross-account permissions and ensures a secure, automated, and seamless pipeline transition.
- C. Incorrect.
Setting up a centralized pipeline in a management account is a valid approach but is less common for multi-account CI/CD pipelines. AWS CodeDeploy may not be the best option for artifact transitions across multiple accounts in this scenario.
- D. Incorrect.
Using a single pipeline in the production account and sharing artifacts directly with development and testing accounts is not a best practice. This approach violates common security principles by giving unnecessary permissions to the production account.