Correct Answer: Central S3 bucket policy allowing cross-account access and IAM roles in member accounts with KMS decryption permissions
Cross-account pipelines require the target accounts to have permissions to the central artifact bucket and the specific KMS key used to encrypt the artifacts....
Correct Answer
Central S3 bucket policy allowing cross-account access and IAM roles in member accounts with KMS decryption permissions
Why This Answer Is Correct
Cross-account pipelines require the target accounts to have permissions to the central artifact bucket and the specific KMS key used to encrypt the artifacts.
This question evaluates your knowledge of Scenario Based — a core concept tested in AWS Certified DevOps Engineer – Professional (DOP-C02). Understanding Scenario Based is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Your team is using AWS CodePipeline to deploy a multi-account application. You want to ensure that a production deployment only occurs if a security scan (SAST) in the staging account passes. How can you implement this cross-account approval and gating mechanism?
An organization wants to implement 'Blue/Green' deployments for their Application Load Balancer-based ECS service. They want to use AWS CodeDeploy to automate the traffic shifting. Which deployment configuration should they use for a zero-downtime, safe transition?
To ensure that all CloudFormation templates deployed across an organization follow security best practices (e.g., no public S3 buckets), which feature of AWS CloudFormation should be used to intercept and validate resource creation?
Your organization wants to automate the patching of thousands of EC2 instances across multiple regions and accounts. They want to ensure that if a patch fails on more than 10% of the fleet, the process stops immediately. Which AWS Systems Manager feature handles this?
To implement a Canary deployment for an AWS Lambda function, you decide to use 'Lambda Aliases' and 'Traffic Shifting'. Which AWS service can automate this process and roll back if CloudWatch Alarms are triggered?