DOP-C02 Question 20
Single answerYou are designing a CI/CD pipeline for an application that will be deployed across multiple AWS accounts (development, staging, and production). The organization requires strict isolation between accounts and wants to ensure that changes are tested in the development account before being promoted to staging or production. Which of the following deployment patterns is the most appropriate for this scenario?
- A
Use AWS CodePipeline with cross-account roles to deploy to each account directly from the same pipeline.
- B
Use separate AWS CodePipeline pipelines in each account, and use AWS CodeCommit repository replication to sync changes between accounts.
- C
Use a central AWS CodePipeline pipeline in the management account, with manual approval actions and cross-account roles to deploy to the staging and production accounts.
- D
Use AWS CodePipeline with AWS Organizations and SCPs to enforce deployment rules across accounts.
Show answer and explanation
Correct answer: C
Explanation
The best practice for CI/CD pipeline deployment in a multi-account environment is to use a central pipeline in a dedicated management account. This approach maintains strict account isolation while leveraging cross-account roles to deploy to target accounts. Manual approval actions ensure that changes are thoroughly reviewed before promotion, reducing the risk of propagating untested changes to production.
- A. Incorrect.
This option violates the principle of account isolation because the same pipeline directly deploys to all accounts, increasing the risk of accidental changes in production.
- B. Incorrect.
This option introduces unnecessary complexity because managing repository replication and syncing changes between accounts is error-prone and not native to AWS CI/CD best practices.
- C. Correct.
This option aligns with best practices for multi-account pipeline deployments. A central pipeline in the management account ensures deployment orchestration while maintaining account isolation. Cross-account roles and manual approval actions enforce strict control over deployments to staging and production.
- D. Incorrect.
This option misunderstands the role of AWS Organizations and SCPs. SCPs are used to enforce service-level permissions but do not manage deployment pipelines or account isolation in CI/CD scenarios.