Question

A company runs CodePipeline in a central Tools account. The pipeline builds artifacts in the Tools account and deploys them via CloudFormation to a separate Production account using a cross-account IAM role. The pipeline's source and build stages succeed, but the deploy stage in the Production account fails with an Amazon S3 'Access Denied' error when the Production role attempts to download the artifact from the pipeline's artifact bucket. The artifact bucket uses a customer managed KMS key for encryption. What must the DevOps engineer configure to resolve the failure?

Accepted Answer

Grant the Production account's deployment role permissions to the artifact S3 bucket AND to the customer managed KMS key, and add the Production role as a grantee in the KMS key policy.

Answer

Change the artifact bucket encryption to SSE-S3 so that no KMS permissions are required across accounts.

Answer

Enable cross-Region replication on the artifact bucket to copy artifacts into the Production account.

Answer

Attach an AdministratorAccess policy to the CodePipeline service role in the Tools account.