DOP-C02 Question 62
Select 2You are managing a CI/CD pipeline using AWS CodePipeline to deploy an application across multiple AWS accounts and regions. The pipeline is failing during the deployment stage in a secondary region due to insufficient permissions. How can you design the deployment process to address this issue while adhering to security best practices?
- A
Use cross-account IAM roles with the required permissions for the deployment stage.
- B
Store the credentials of the target account in AWS Secrets Manager and retrieve them during the deployment.
- C
Grant the CodePipeline service role administrative permissions across all accounts involved in the deployment.
- D
Use AWS Systems Manager Parameter Store to manage and retrieve deployment configurations securely.
- E
Leverage AWS Organizations Service Control Policies (SCPs) to enforce permissions for the deployment process.
Show answer and explanation
Correct answers: A, D
Explanation
To securely deploy applications across multiple AWS accounts and regions, you should use cross-account IAM roles to grant temporary access to the resources required for deployment. This approach adheres to the principle of least privilege and avoids storing static credentials. Additionally, AWS Systems Manager Parameter Store can be used to securely manage deployment configurations, ensuring sensitive information is handled safely. Together, these practices align with security best practices while enabling a seamless deployment process.
- A. Correct.
Using cross-account IAM roles with the required permissions is the recommended approach for securely managing resources across multiple AWS accounts. It avoids the need to store static credentials and adheres to the principle of least privilege.
- B. Incorrect.
Storing credentials of the target account in AWS Secrets Manager is not a secure or scalable method for managing access across accounts. AWS recommends using IAM roles for cross-account access instead.
- C. Incorrect.
Granting the CodePipeline service role administrative permissions violates the principle of least privilege and increases the risk of accidental or malicious changes.
- D. Correct.
AWS Systems Manager Parameter Store is a secure and scalable way to manage deployment configurations, such as parameter values, in a multi-account and multi-region setup.
- E. Incorrect.
While AWS Organizations SCPs can restrict permissions at the account level, they cannot provide the necessary temporary access credentials required for deployment. They are used for governance rather than operational access control.