Question

A financial services company uses CodePipeline with CodeCommit as the source, CodeBuild for compilation, and CodeDeploy for EC2 deployments. Auditors require that every deployed artifact be traceable to the exact Git commit that produced it, and that the same artifact promoted to production is bit-for-bit identical to what was tested in staging. Currently, the team has two separate pipelines: one that builds and deploys to staging, and another that independently rebuilds from source and deploys to production. Auditors flagged that production artifacts cannot be guaranteed identical to staging artifacts. Which change BEST satisfies the traceability and identical-artifact requirements?

Accepted Answer

Consolidate into a single pipeline where CodeBuild produces one artifact stored in the S3 artifact store, then promote that same output artifact through staging and production deploy stages, using the CodePipeline execution's source commit ID for traceability.

Answer

Keep two pipelines but configure both CodeBuild projects to check out the same Git tag, ensuring deterministic builds that produce identical artifacts in each environment.

Answer

Enable CodeArtifact as the artifact store for both pipelines and rely on package version pinning so production and staging resolve to the same dependency versions.

Answer

Add a manual approval action in the production pipeline that requires an engineer to verify the artifact checksum matches staging before the deploy stage proceeds.