DOP-C02 Practice Question 2: Cross Account Pipeline Artifacts
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 1 · question 2 of 10
A central Tooling account hosts an AWS CodePipeline pipeline that must deploy into separate Dev, Staging, and Production accounts in the same AWS Organization. An engineer adds a CodeDeploy deploy action pointing at the Production account's application and sets the action's roleArn to a role in that account. The action fails immediately, and the CodeDeploy service in Production reports that it cannot read the input artifact from the pipeline's Amazon S3 artifact bucket.
Which combination of changes will make the cross-account action work?
Show answer and explanation
Answer:
Cross-account CodePipeline actions have a specific and non-obvious prerequisite: the artifact bucket must be encrypted with a customer managed AWS KMS key rather than the default AWS managed key for S3. An AWS managed key's policy cannot be edited, so a principal in another account can never be granted kms:Decrypt on it; the artifact download fails at decryption even if the S3 bucket policy is perfect. The complete working set is exactly the four pieces in option B: a customer managed key whose key policy grants the pipeline service role and the target account usage; a bucket policy granting the target account s3:GetObject/s3:ListBucket (and s3:PutObject if that account produces output artifacts); an sts:AssumeRole permission on the pipeline service role for the target account's role; and a trust policy on that target role that trusts the pipeline service role. The action then declares the target role in its roleArn.
Option A does not help. Relocating the bucket does not change the fact that the default S3 managed key cannot be shared across accounts, and CodePipeline expects its artifact store in the pipeline's own account and Region. It also breaks Dev and Staging, which read from the same store.
Option C is a permissions non-answer. AWSCodePipelineFullAccess grants CodePipeline API permissions in the *Production* account, not access to the Tooling account's bucket or key; resource policies in the owning account still gate that. Cross-Region Replication copies objects to a different bucket, so the pipeline action would still be reading the original artifact location, and the copies would arrive too late to be useful mid-execution.
Option D confuses artifact stores with image registries. CodePipeline's artifact store is always S3; there is no ECR-backed artifact store, and RAM does not share ECR repositories in the way described. Container images are a payload the pipeline may reference, not a replacement for the artifact bucket.
Reference: Create a pipeline in CodePipeline that uses resources from another AWS account