Question

A company uses a centralized DevOps account to run a single AWS CodePipeline that deploys a CloudFormation stack into three separate workload accounts (dev, staging, prod). The pipeline artifacts are stored in an S3 bucket and encrypted with a customer-managed KMS key in the DevOps account. During the deploy stage targeting the prod account, the CodePipeline CloudFormation deploy action fails with an error indicating it cannot access the deployment role in the target account. The pipeline service role and a cross-account deployment role already exist. Which combination of configuration steps is required so the deploy action can assume the role and create the stack in prod?

Accepted Answer

Configure the CodePipeline CloudFormation deploy action with a RoleArn pointing to a role in the prod account, ensure the pipeline service role can sts:AssumeRole into the prod cross-account role, and grant the prod deployment role a passable CloudFormation service role plus decrypt permissions on the DevOps KMS key.

Answer

Move the artifact S3 bucket and KMS key into the prod account and reconfigure the pipeline to use the prod account's default AWS managed encryption keys for all cross-account artifacts.

Answer

Add the prod account as a trusted entity only on the pipeline service role and enable automatic cross-account role chaining, which CodePipeline handles without any additional KMS grants.

Answer

Replace the CloudFormation deploy action with a CodeBuild action in the prod account that runs the AWS CLI, since CloudFormation deploy actions cannot operate across accounts.