Question

A team uses CodePipeline with an S3 artifact store. The Source stage pulls from CodeCommit, and a Build stage produces a deployment package. Auditors require that the exact artifact deployed to production be retrievable for any past pipeline execution for at least one year, even if a later build overwrites files at the same S3 key. The pipeline currently uses the default artifact store configuration. What change should the DevOps engineer make to satisfy this requirement with the least operational overhead?

Accepted Answer

Enable versioning on the S3 artifact bucket and configure a lifecycle rule to retain noncurrent versions for at least one year.

Answer

Add a CodeBuild step that copies each artifact to a separate S3 bucket using a unique key derived from the execution ID.

Answer

Configure CodePipeline to use a separate artifact bucket per pipeline execution via a Lambda invoke action.

Answer

Enable S3 Object Lock in compliance mode on the artifact bucket for a one-year retention period.