Question

A company keeps its CI/CD tooling in a central 'Tools' AWS account. A CodePipeline in this account builds artifacts with CodeBuild and must deploy a CloudFormation stack into a separate 'Production' AWS account. The pipeline's CloudFormation deploy action fails with an access-denied error when it tries to create resources in the Production account. What is the correct way to enable this cross-account deployment?

Accepted Answer

In the Production account, create an IAM role that trusts the Tools account and grants CloudFormation permissions; reference this role in the pipeline's CloudFormation deploy action so it assumes the role, and grant the pipeline's artifact S3 bucket and KMS key cross-account access.

Answer

Copy the CodePipeline service role's access keys into the Production account and configure CloudFormation to use those long-term credentials during stack creation.

Answer

Enable AWS Organizations service control policies that automatically allow any pipeline in the Tools account to deploy CloudFormation stacks in member accounts without additional roles.

Answer

Recreate the entire pipeline inside the Production account so that no cross-account permissions are required, and manually copy build artifacts between accounts.