AWS DevOps DevOps CI/CD Pipeline Design & Implementation 4 — Questions and Answers
Question 1: A company wants to enforce that every container image deployed to ECS was built by their CodeBuild pipeline and has not been tampered with. Which AWS service enforces this?
- Amazon Inspector container scanning integrated with CodePipeline
- AWS Signer with container image signing and ECR image tag immutability (Correct answer)
- Amazon Macie monitoring ECR repositories for sensitive data
- AWS Config rule checking ECS task definition image URIs
Correct answer: AWS Signer with container image signing and ECR image tag immutability
AWS Signer can sign container images, and combined with ECR immutable tags and IAM policies, ensures only pipeline-signed images are deployable to ECS.
Question 2: In a multi-account AWS CI/CD setup, a CodePipeline in the tools account needs to deploy CloudFormation stacks in a production account. What mechanism enables cross-account deployment?
- Use AWS Organizations SCPs to grant CodePipeline cross-account permissions
- Create a cross-account IAM role in the production account and configure CodePipeline to assume it during deployment (Correct answer)
- Deploy a CodePipeline instance in the production account that mirrors the tools account pipeline
- Use VPC peering between the tools and production accounts to share pipeline artifacts
Correct answer: Create a cross-account IAM role in the production account and configure CodePipeline to assume it during deployment
Cross-account deployments require a deployment role in the target account that the pipeline's role in the tools account can assume; the S3 artifact bucket must also grant the target account access.
Question 3: A pipeline should automatically roll back an ECS service deployment if the average CPU exceeds 80% for 5 minutes after release. Which AWS feature implements this?
- CodeDeploy deployment group with a CloudWatch alarm configured to trigger automatic rollback (Correct answer)
- Lambda function polling CloudWatch metrics and calling the CodeDeploy StopDeployment API
- ECS service auto scaling policy that terminates the new task version on high CPU
- CloudWatch Synthetics canary that runs CPU checks and reverts the ECS task definition
Correct answer: CodeDeploy deployment group with a CloudWatch alarm configured to trigger automatic rollback
CodeDeploy deployment groups support CloudWatch alarm-based automatic rollback; if the alarm fires during or after deployment, CodeDeploy reverts to the previous version.
Question 4: Which CodeBuild environment variable is automatically provided and contains the S3 URL of the input artifact for the current build?
- CODEBUILD_SOURCE_VERSION
- CODEBUILD_INITIATOR
- CODEBUILD_SRC_DIR (Correct answer)
- CODEBUILD_BUILD_ARN
Correct answer: CODEBUILD_SRC_DIR
CODEBUILD_SRC_DIR contains the absolute path of the directory where CodeBuild places the downloaded source (or input artifact) for the build.
Question 5: A team wants to test infrastructure changes using CloudFormation before deploying to production. Which CodePipeline action type supports deploying a change set for review without executing it?
- AWS CloudFormation DEPLOY action with DisableRollback set to true
- AWS CloudFormation CREATE_UPDATE action targeting a staging stack
- AWS CloudFormation CREATE_CHANGE_SET action followed by a manual approval and EXECUTE_CHANGE_SET action (Correct answer)
- AWS CloudFormation REPLACE_ON_FAILURE action with a manual gate
Correct answer: AWS CloudFormation CREATE_CHANGE_SET action followed by a manual approval and EXECUTE_CHANGE_SET action
The CREATE_CHANGE_SET action generates a CloudFormation change set for review; after a manual approval gate, EXECUTE_CHANGE_SET applies the changes, providing a safe review workflow.
Question 6: Which AWS CodePipeline action provider allows you to run a custom script or tool that is not natively supported by CodePipeline?
- AWS CodeBuild action with a custom buildspec.yml
- AWS Lambda action invoking a function with pipeline event data
- AWS CloudFormation action with a custom resource handler
- Both A and B are valid approaches (Correct answer)
Correct answer: Both A and B are valid approaches
Both CodeBuild (arbitrary script execution in a build container) and Lambda (serverless custom logic) are valid extensibility points for unsupported operations in CodePipeline.
Question 7: A security team requires that all pipeline artifacts be encrypted with a customer-managed KMS key rather than the default AWS-managed key. Where is this configured?
- In the CodeBuild project's environment variables as KMS_KEY_ARN
- In the CodePipeline pipeline configuration under the artifact store encryption key setting (Correct answer)
- In the S3 bucket default encryption policy applied to the artifact bucket
- In the IAM role policy attached to the CodePipeline service role
Correct answer: In the CodePipeline pipeline configuration under the artifact store encryption key setting
CodePipeline's artifact store configuration accepts an optional encryption key field where you specify a customer-managed KMS key ARN to encrypt all pipeline artifacts.
AWS DevOps DevOps CI/CD Pipeline Design & Implementation 4
A company wants to enforce that every container image deployed to ECS was built by their CodeBuild pipeline and has not been tampered with.
Which AWS service enforces this?