Design Solutions for Organizational Complexity1 / 5
A company has a multi-account AWS Organization with a central shared services account, a development account, and a production account. They want to implement a CI/CD pipeline where code is committed in the development account, built and tested in the shared services account, and deployed to the production account. The pipeline must use AWS CodePipeline and minimize cross-account credential management complexity. Which approach should the solutions architect recommend?
CorrectIncorrect
Alex
Cross-account CI/CD pipelines in AWS Organizations use CodePipeline in a central shared services account with cross-account IAM roles for deployment. The pipeline assumes roles in target accounts (dev, prod) to deploy resources, maintaining least-privilege access. A shared KMS key encrypts artifacts in the S3 artifact bucket, and the key policy grants usage to the cross-account roles. This pattern avoids giving developers direct access to production while enabling automated deployments. Placing separate pipelines in each account creates management overhead and inconsistency. Using organization-wide admin roles violates least privilege. CodeDeploy agents pulling from S3 skips the orchestration and approval capabilities of CodePipeline. Exam tip: Cross-account CodePipeline requires three components: cross-account IAM roles, shared KMS key, and S3 artifact bucket with appropriate bucket policies.
Sourcedocs.aws.amazon.com
Follow-up answers are available in the app. Create a free account — no credit card required.
Question 1 of 5
Create a free account