DOP-C02 Question 18
Select 2Your organization has a multi-account AWS environment with separate accounts for development, testing, and production. You are tasked with implementing a CI/CD pipeline to deploy an application across these accounts. The pipeline should ensure that only approved changes are promoted to the production account. Which of the following approaches should you use to design the pipeline?
- A
Use AWS CodePipeline with cross-account roles to deploy artifacts sequentially to development, testing, and production accounts.
- B
Create separate AWS CodePipeline pipelines in each account and use an Amazon S3 bucket to transfer artifacts between accounts.
- C
Use AWS CodePipeline with AWS Systems Manager Parameter Store to manage cross-account deployment configurations.
- D
Deploy artifacts to a single shared account and manually copy them to the other accounts as needed.
- E
Integrate AWS CodePipeline with AWS Service Catalog to deploy approved application versions across accounts.
Show answer and explanation
Correct answers: A, C
Explanation
In a multi-account environment, using AWS CodePipeline with cross-account roles is a best practice as it allows you to automate deployments securely across accounts while maintaining access control. AWS Systems Manager Parameter Store complements this design by securely managing deployment configurations, reducing complexity and improving maintainability. Other options either introduce unnecessary complexity or do not align with DevOps automation principles.
- A. Correct.
This is correct. Using AWS CodePipeline with cross-account roles allows secure and automated deployments across multiple accounts, while maintaining proper access control.
- B. Incorrect.
This is incorrect. While this approach might work, it introduces complexity, such as managing artifact versioning and permissions manually, which is not optimal for multi-account CI/CD pipelines.
- C. Correct.
This is correct. AWS Systems Manager Parameter Store can be used to store cross-account deployment configurations securely, simplifying the pipeline design for multi-account environments.
- D. Incorrect.
This is incorrect. Manually copying artifacts between accounts is error-prone, not scalable, and doesn't align with DevOps best practices or automation principles.
- E. Incorrect.
This is incorrect. While AWS Service Catalog can be used for managing pre-approved resources, it is not designed as a primary tool for CI/CD pipeline deployments across accounts.